Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- How to determine age of events in frozen buckets?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to determine age of events in frozen buckets?
Hi!
I configured my deployment to store frozen buckets. But, now i have only 15% empty in my partition.
I need to delete some buckets. I want to know how to determine age of events in frozen buckets for resolves this problem.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@wmedeiros, you can use dbinspect command to perform this analysis on volume/age by buckets:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Dbinspect
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
db_<newest_time>_<oldest_time>_<localid>_<guid>
The times are in UTC epoch.
http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/HowSplunkstoresindexes
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks.
I have this bucket "db_1467575622_1467543210_820". I understood that the newest_time=1467575622 and oldest_time=1 467 543 210.
This time are in seconds, but how to transform this time in Date?
1 day has 87400 seconds (24*60*60).
1 year has 31536000 seconds (87400*365)
1467575622 seconds are 46.53 years (1467575622/31536000)
How to determine the age of these events ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Those are epoch time, please use https://www.epochconverter.com/ to convert epoch time to human readable format.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
