Getting Data In
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

How can I identify buckets with past and future events

tkw03
Communicator
‎12-09-2020 06:52 AM

Hello

 

I have a windows index that has data as old as 14000+ days. From researching its because there is data that is way to far in the past and way to far into the future. Unfortunately this data wont roll due to the dates and is filling beyond where the index should fill.

 

How can I identify the buckets across the cluster that contain this data? I need to know the buckets so I can decide what to do with them.

 

Thanks!

Labels (1)
Labels
0 Karma
Reply
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 6)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...