Alerting

How can I get an email alert once my index is close to its retention period?

csahoo
Explorer

Hi All,


I am using Splunk Cloud where I have an index whose retention period is set as 10 years, so I just want to understand how can I get an email alert once my index is close to its retention period .

Labels (4)
0 Karma

somesoni2
Revered Legend

You can run something like this to get alert when minimum time (timestamp of oldest event in the index) is older than 90% of the retention period:-

| rest /services/data/indexes | table title minTime frozenTimePeriodInSecs | convert mktime(minTime) timeformat="%FT%T%z"  | where now()-minTime>frozenTimePeriodInSecs*0.9 | convert ctime(minTime) | eval retention=tostring(frozenTimePeriodInSecs,"duration")

 Problem with this is that it may give false positive. The retention is done based on size as well as age. Also, retention is done by the bucket and bucket is retired only when the newest event in the index is older than retention period. You can get an indication with this search but it may not be 100% full proof.

PickleRick
SplunkTrust
SplunkTrust

With dbinspect you can get details of single buckets. So dbinspect should give enough details to warn against both rolling oldest bucket as well as hitting size limit.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...