I have a 'frozenTimePeriodInSecs' conf set - how can I tell whats 'aging' out today, tomorrow etc. How much data in GB ??
Correct. It also shows what was frozen, not what will be frozen.
To see what will will be frozen, build a query around the
dbinspect command. Here's an example I received from someone else:
| dbinspect index=foo | search NOT state=hot | eval frozenTimePeriodInSecs = [| rest /services/data/indexes | search title=foo [| rest /services/server/roles | search role_list="indexer" | fields splunk_server] | dedup frozenTimePeriodInSecs | return $frozenTimePeriodInSecs] | eval shouldfreeze = endEpoch + frozenTimePeriodInSecs | where shouldfreeze < now() | convert ctime(shouldfreeze), ctime(*Epoch) | table splunk_server bucketId frozenTimePeriodInSecs startEpoch endEpoch shouldfreeze