The following stanza is active in indexes.conf: [cat_facts] maxHotSpanSecs = 3600 frozenTimePeriodInSecs = 2630000 maxTota1DataSizeMB = 650000 All other related indexes.conf settings are default…

Hot bucket lifespan is capped by maxHotSpanSecs = 3600 seconds (1 hour), so an event 3,739,283 seconds old could never still be in a hot bucket - and even if it were, its age exceeds frozenTimePeriodInSecs, making it expired.

The index size limit (maxTotalDataSizeMB = 650,000 MB) triggers size-based retention separately from time-based retention - the event in question is unsearchable due to age expiration via frozenTimePeriodInSecs, not because the index exceeded its size cap.

Index size being below 650,000 MB is relevant only for size-based bucket freezing - since this event has already exceeded the time-based frozenTimePeriodInSecs threshold, the index size has no bearing on whether this event is searchable.

frozenTimePeriodInSecs = 2,630,000 seconds (approximately 30.4 days) is the maximum age threshold before a bucket is frozen and removed from the searchable index. Since the event timestamp is 3,739,283 seconds ago (approximately 43.3 days), it exceeds this retention window, meaning the bucket was already frozen and the event cannot be searched regardless of current index size or bucket state.