What does the term "frozen" refer to in the context of Splunk data buckets?

The term "frozen" in the context of Splunk data buckets specifically refers to data that has been archived and is no longer actively accessible through standard querying. When data is processed in Splunk, it moves through various stages (hot, warm, cold, and finally frozen) based on its age and usage. Once data becomes frozen, it is typically deleted or moved to a less accessible storage medium based on the retention policies defined for your data.

This distinction is significant because it helps manage data lifecycle and storage efficiency within Splunk. By understanding that "frozen" denotes data that is not readily available for queries, one can better strategize data management, optimize performance, and decide on appropriate archival solutions when operating with large datasets.