How can I get an email alert once my index is close to its retention period?

[csahoo]

Hi All,

I am using Splunk Cloud where I have an index whose retention period is set as 10 years, so I just want to understand how can I get an email alert once my index is close to its retention period .

[somesoni2]

You can run something like this to get alert when minimum time (timestamp of oldest event in the index) is older than 90% of the retention period:-

| rest /services/data/indexes | table title minTime frozenTimePeriodInSecs | convert mktime(minTime) timeformat="%FT%T%z"  | where now()-minTime>frozenTimePeriodInSecs*0.9 | convert ctime(minTime) | eval retention=tostring(frozenTimePeriodInSecs,"duration")

 Problem with this is that it may give false positive. The retention is done based on size as well as age. Also, retention is done by the bucket and bucket is retired only when the newest event in the index is older than retention period. You can get an indication with this search but it may not be 100% full proof.

[PickleRick]

With dbinspect you can get details of single buckets. So dbinspect should give enough details to warn against both rolling oldest bucket as well as hitting size limit.