I have my frozen time set like this`frozenTimePeriodInSecs = 47304000` (1.5 years)
yet when I do this search `| metadata index=foo type=hosts | stats max(lastTime) as lastTime, min(firstTime) as firstTime | convert ctime(*Time)` my "firstTime" is more than two years from my "lastTime"
`lastTime firstTime`
`02/06/2017 07:10:40 01/16/2015 09:18:53`
this is more than 2 years of data.
How can I force retention time pruning or find out why pruning it not running correctly.
↧