topic Re: Splunk index roll-out information? in Monitoring Splunk https://community.splunk.com/t5/Monitoring-Splunk/Splunk-index-roll-out-information/m-p/235325#M2316 <P>Thank You </P> Fri, 07 Oct 2016 05:54:53 GMT rsathish47 2016-10-07T05:54:53Z Splunk index roll-out information? https://community.splunk.com/t5/Monitoring-Splunk/Splunk-index-roll-out-information/m-p/235321#M2312 <P>Hi All,</P> <P>I have to build dashboard for Splunk index roll-out information From hot to Warm Warm to Cold and Cold to Frozen ? Please let me which internal index and source-type I need to use to get this detail?</P> Thu, 06 Oct 2016 11:09:30 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-index-roll-out-information/m-p/235321#M2312 rsathish47 2016-10-06T11:09:30Z Re: Splunk index roll-out information? https://community.splunk.com/t5/Monitoring-Splunk/Splunk-index-roll-out-information/m-p/235322#M2313 <P>What exactly do you want to display on the dashboard?</P> Thu, 06 Oct 2016 11:58:11 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-index-roll-out-information/m-p/235322#M2313 richgalloway 2016-10-06T11:58:11Z Re: Splunk index roll-out information? https://community.splunk.com/t5/Monitoring-Splunk/Splunk-index-roll-out-information/m-p/235323#M2314 <P>I have to show the no.of bytes and time it got transferred </P> Thu, 06 Oct 2016 12:07:54 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-index-roll-out-information/m-p/235323#M2314 rsathish47 2016-10-06T12:07:54Z Re: Splunk index roll-out information? https://community.splunk.com/t5/Monitoring-Splunk/Splunk-index-roll-out-information/m-p/235324#M2315 <P>you can use this query and get details...you can fine-tune your requirement and create the dashboard - </P> <P><CODE>index=_internal sourcetype=splunkd bucketmover</CODE></P> <P>10/6/16 7:44:06.942 AM 10-06-2016 07:44:06.942 -0400 INFO BucketMover - idx=windows Moving bucket='db_1475034240_1474948377_1671' because maximum number of warm databases exceeded, starting warm_to_cold: from='/opt/splunk_hot/window</P> <P>10/6/16 8:00:39.724 AM 10-06-2016 08:00:39.724 -0400 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk_cold/_internaldb/colddb/db_1473163226_1473156927_1613'</P> <P>10/6/16 8:02:00.852 AM 10-06-2016 08:02:00.852 -0400 INFO BucketMover - will attempt to freeze: candidate='/opt/splunk_cold/_internaldb/colddb/db_1473163314_1446206601_2368' because frozenTimePeriodInSecs=2592000 is exceeded by the difference between now=1475755320 and latest=1473163314</P> <PRE><CODE> |dbinspect index=main|convert timeformat=""%m/%d/%Y:%H:%M:%S"" mktime(earliestTime) as earliestTime|convert timeformat=""%m/%d/%Y:%H:%M:%S"" mktime(latestTime) as latestTime|stats min(earliestTime) as earliestTime max(latestTime) as latestTime sum(sizeOnDiskMB) as sizeOnDiskMB dc(path) as NumberOfBuckets by state|eval diff_seconds=(latestTime-earliestTime)/3600|eval earliestTime=strftime(earliestTime,"%m/%d/%Y:%H:%M:%S")|eval latestTime=strftime(latestTime,"%m/%d/%Y:%H:%M:%S") </CODE></PRE> <P>The result set for this query is something like this:</P> <PRE><CODE> state earliestTime latestTime sizeOnDiskMB NumberOfBuckets hot 09/15/2006:18:47:20 03/24/2012:12:00:00 10043.741711 10 warm 02/19/2012:00:00:01 03/21/2012:03:59:00 92646.695278 20 cold 01/03/2006:16:35:20 02/27/2012:17:00:00 204971.245710 586 </CODE></PRE> Tue, 29 Sep 2020 11:17:41 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-index-roll-out-information/m-p/235324#M2315 inventsekar 2020-09-29T11:17:41Z Re: Splunk index roll-out information? https://community.splunk.com/t5/Monitoring-Splunk/Splunk-index-roll-out-information/m-p/235325#M2316 <P>Thank You </P> Fri, 07 Oct 2016 05:54:53 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-index-roll-out-information/m-p/235325#M2316 rsathish47 2016-10-07T05:54:53Z