There are two data bucket retention periods of interest for Splunk:
The Hot/Warm bucket is used for live incoming data. You need the fastest search performance on this data. Retention periods are usually numbered in days. This bucket is the location that new incoming data lands.
The Cold bucket is used for older data whose expected search performance can be reduced. The data here was moved from the Hot/Warm buckets.