How to search and table the retention time of each hot, warm, cold, and frozen bucket by each index?

[dpraveen88]

Let's take an Example.

I have 3 indexes:
Index1, Index2, Index3

For each index the data moves from hot to warm, warm to cold, cold to frozen.

I want to create a table of each index "retention period time" of each "bucket".

[mrgibbon · Accepted solution]

Hmm, try this for indexes:

| rest /services/admin/indexes | eval yr = floor(frozenTimePeriodInSecs/86400/365)| eval dy = (frozenTimePeriodInSecs/86400) % 365 | eval ret = yr . " years, " . dy . " days" | stats list(splunk_server) list(frozenTimePeriodInSecs) list(ret) by title  

And this for buckets:

| dbinspect index=* | join index [|rest /services/data/indexes| eval index=title | table index frozenTimePeriodInSecs ] | eval toNow=now()-endEpoch | convert num(toNow) | convert num(frozenTimePeriodInSecs) | convert ctime(endEpoch) AS endEvent | convert ctime(startEpoch) AS startEvent | eval shouldBeFrozen=if( ( state!="hot" AND state!="thawed" ) AND toNow>frozenTimePeriodInSecs,"yes","no") | table index path id state startEvent endEvent shouldBeFrozen toNow frozenTimePeriodInSecs 

[gcusello]

I'm not connected now, but in Distributed Management Console there shuold be these information.
Otherwise there is an app to do this.
Bye.
Giuseppe