topic Re: Determine how much data splunk is going to 'archive' in Getting Data In

Determine how much data splunk is going to 'archive'

tb5821 — Wed, 06 Nov 2019 14:24:47 GMT

I have a 'frozenTimePeriodInSecs' conf set - how can I tell whats 'aging' out today, tomorrow etc. How much data in GB ??
https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/SetARetirementAndArchivingPolicy

Re: Determine how much data splunk is going to 'archive'

richgalloway — Wed, 06 Nov 2019 16:17:56 GMT

Look in the internal index for bucketmover events.

index=_internal component=BucketMover "freeze"

Re: Determine how much data splunk is going to 'archive'

tb5821 — Wed, 06 Nov 2019 16:46:28 GMT

hmm that doesn't appear to show the size of whats going to be frozen

Re: Determine how much data splunk is going to 'archive'

richgalloway — Wed, 06 Nov 2019 18:20:30 GMT

Correct. It also shows what was frozen, not what will be frozen.
To see what will will be frozen, build a query around the dbinspect command. Here's an example I received from someone else:

| dbinspect index=foo
| search NOT state=hot 
| eval frozenTimePeriodInSecs = [| rest /services/data/indexes 
    | search title=foo 
        [| rest /services/server/roles 
        | search role_list="indexer" 
        | fields splunk_server] 
    | dedup frozenTimePeriodInSecs 
    | return $frozenTimePeriodInSecs]
| eval shouldfreeze = endEpoch + frozenTimePeriodInSecs 
| where shouldfreeze < now() 
| convert ctime(shouldfreeze), ctime(*Epoch) 
| table splunk_server bucketId frozenTimePeriodInSecs startEpoch endEpoch shouldfreeze