All,
I am on a roll for questions today. Just learning Firebrigade here, cool app. But I don't understand how it's possible that I can have data in an index older than the max age of the index?
I have a 30 day max on my activemq index but we can see data 48 days old in there. Shouldn't splunk dump that? Is there a way to force it to dump?
![alt text][1]
[1]: /storage/temp/128214-firebrigade.png
↧