Deployment Architecture
Highlighted

How to search and table the retention time of each hot, warm, cold, and frozen bucket by each index?

Explorer

Let's take an Example.

I have 3 indexes:
Index1, Index2, Index3

For each index the data moves from hot to warm, warm to cold, cold to frozen.

I want to create a table of each index "retention period time" of each "bucket".

0 Karma
Highlighted

Re: How to search and table the retention time of each hot, warm, cold, and frozen bucket by each index?

Legend

I'm not connected now, but in Distributed Management Console there shuold be these information.
Otherwise there is an app to do this.
Bye.
Giuseppe

0 Karma
Highlighted

Re: How to search and table the retention time of each hot, warm, cold, and frozen bucket by each index?

Contributor

Hmm, try this for indexes:

| rest /services/admin/indexes | eval yr = floor(frozenTimePeriodInSecs/86400/365)| eval dy = (frozenTimePeriodInSecs/86400) % 365 | eval ret = yr . " years, " . dy . " days" | stats list(splunk_server) list(frozenTimePeriodInSecs) list(ret) by title  

And this for buckets:

| dbinspect index=* | join index [|rest /services/data/indexes| eval index=title | table index frozenTimePeriodInSecs ] | eval toNow=now()-endEpoch | convert num(toNow) | convert num(frozenTimePeriodInSecs) | convert ctime(endEpoch) AS endEvent | convert ctime(startEpoch) AS startEvent | eval shouldBeFrozen=if( ( state!="hot" AND state!="thawed" ) AND toNow>frozenTimePeriodInSecs,"yes","no") | table index path id state startEvent endEvent shouldBeFrozen toNow frozenTimePeriodInSecs 

View solution in original post