topic Re: How to search and table the retention time of each hot, warm, cold, and frozen bucket by each index? in Deployment Architecture

How to search and table the retention time of each hot, warm, cold, and frozen bucket by each index?

dpraveen88 — Tue, 22 Nov 2016 15:16:30 GMT

Let's take an Example.

I have 3 indexes:
Index1, Index2, Index3

For each index the data moves from hot to warm, warm to cold, cold to frozen.

I want to create a table of each index "retention period time" of each "bucket".

Re: How to search and table the retention time of each hot, warm, cold, and frozen bucket by each index?

gcusello — Tue, 22 Nov 2016 15:43:03 GMT

I'm not connected now, but in Distributed Management Console there shuold be these information.
Otherwise there is an app to do this.
Bye.
Giuseppe

Re: How to search and table the retention time of each hot, warm, cold, and frozen bucket by each index?

mrgibbon — Tue, 22 Nov 2016 22:47:23 GMT

Hmm, try this for indexes:

| rest /services/admin/indexes | eval yr = floor(frozenTimePeriodInSecs/86400/365)| eval dy = (frozenTimePeriodInSecs/86400) % 365 | eval ret = yr . " years, " . dy . " days" | stats list(splunk_server) list(frozenTimePeriodInSecs) list(ret) by title

And this for buckets:

| dbinspect index=* | join index [|rest /services/data/indexes| eval index=title | table index frozenTimePeriodInSecs ] | eval toNow=now()-endEpoch | convert num(toNow) | convert num(frozenTimePeriodInSecs) | convert ctime(endEpoch) AS endEvent | convert ctime(startEpoch) AS startEvent | eval shouldBeFrozen=if( ( state!="hot" AND state!="thawed" ) AND toNow>frozenTimePeriodInSecs,"yes","no") | table index path id state startEvent endEvent shouldBeFrozen toNow frozenTimePeriodInSecs