Cribl Lake Search Displays Events Older Than the Configured Retention Period

Symptom

When searching a Cribl Lake dataset, returned events appear in Search with timestamps significantly older than the configured retention period. For example, a dataset created in 2026 with a 365-day retention period displays events from 2017.

Environment

• Cribl Lake
• Cribl Stream

Resolution

1. Run the following .show objects command in Cribl Search to check the object's lastModified date for the dataset in question:
   .show objects('<dataset_name>')

| project name, lastModified, size

| extend lastModifiedReadable = strftime(lastModified, '%Y-%m-%dT%H:%M:%S.%L%Z')

2. Review the lastModifiedReadable field in the results. If it shows a recent date, the data is within the retention window and no action is needed.

This is the expected behavior.

Cause

Cribl Lake retention is calculated based on the date data was uploaded to Lake, not the event timestamp (_time). When historical data is ingested via Stream and routed to Lake, Stream preserves the original _time from the source data by default. Lake then partitions files using that event time, which is also what Search uses to display events on the timeline.

This creates the appearance that data outside the retention window still exists, when in reality the retention clock started at ingestion and not at the event date.

_time would only be overridden if a pipeline includes an Auto Timestamp function, Eval function, or other explicit timestamp manipulation before the Lake destination.

Last Validated

4.17.0

Additional Information

For more information, see How Lake Datasets Retention Is Calculated.