Determine how much data splunk is going to 'archive'

[tb5821]

I have a 'frozenTimePeriodInSecs' conf set - how can I tell whats 'aging' out today, tomorrow etc. How much data in GB ??
https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/SetARetirementAndArchivingPolicy

[richgalloway]

Look in the internal index for bucketmover events.

index=_internal component=BucketMover "freeze"

[tb5821]

hmm that doesn't appear to show the size of whats going to be frozen

[richgalloway]

Correct. It also shows what was frozen, not what will be frozen.
To see what will will be frozen, build a query around the dbinspect command. Here's an example I received from someone else:

| dbinspect index=foo
| search NOT state=hot 
| eval frozenTimePeriodInSecs = [| rest /services/data/indexes 
    | search title=foo 
        [| rest /services/server/roles 
        | search role_list="indexer" 
        | fields splunk_server] 
    | dedup frozenTimePeriodInSecs 
    | return $frozenTimePeriodInSecs]
| eval shouldfreeze = endEpoch + frozenTimePeriodInSecs 
| where shouldfreeze < now() 
| convert ctime(shouldfreeze), ctime(*Epoch) 
| table splunk_server bucketId frozenTimePeriodInSecs startEpoch endEpoch shouldfreeze