Let's take an Example.
I have 3 indexes:
Index1, Index2, Index3
For each index the data moves from hot to warm, warm to cold, cold to frozen.
I want to create a table of each index "retention period time" of each "bucket".
Hmm, try this for indexes:
| rest /services/admin/indexes | eval yr = floor(frozenTimePeriodInSecs/86400/365)| eval dy = (frozenTimePeriodInSecs/86400) % 365 | eval ret = yr . " years, " . dy . " days" | stats list(splunk_server) list(frozenTimePeriodInSecs) list(ret) by title
And this for buckets:
| dbinspect index=* | join index [|rest /services/data/indexes| eval index=title | table index frozenTimePeriodInSecs ] | eval toNow=now()-endEpoch | convert num(toNow) | convert num(frozenTimePeriodInSecs) | convert ctime(endEpoch) AS endEvent | convert ctime(startEpoch) AS startEvent | eval shouldBeFrozen=if( ( state!="hot" AND state!="thawed" ) AND toNow>frozenTimePeriodInSecs,"yes","no") | table index path id state startEvent endEvent shouldBeFrozen toNow frozenTimePeriodInSecs
Hmm, try this for indexes:
| rest /services/admin/indexes | eval yr = floor(frozenTimePeriodInSecs/86400/365)| eval dy = (frozenTimePeriodInSecs/86400) % 365 | eval ret = yr . " years, " . dy . " days" | stats list(splunk_server) list(frozenTimePeriodInSecs) list(ret) by title
And this for buckets:
| dbinspect index=* | join index [|rest /services/data/indexes| eval index=title | table index frozenTimePeriodInSecs ] | eval toNow=now()-endEpoch | convert num(toNow) | convert num(frozenTimePeriodInSecs) | convert ctime(endEpoch) AS endEvent | convert ctime(startEpoch) AS startEvent | eval shouldBeFrozen=if( ( state!="hot" AND state!="thawed" ) AND toNow>frozenTimePeriodInSecs,"yes","no") | table index path id state startEvent endEvent shouldBeFrozen toNow frozenTimePeriodInSecs
I'm not connected now, but in Distributed Management Console there shuold be these information.
Otherwise there is an app to do this.
Bye.
Giuseppe