Getting Data In

How to total the buckets that will roll from cold to frozen when changing frozenTimePeriodinSecs

wardallen
Path Finder

I'm running out of space in my cold bucket volume, and want to reduce the default frozenTimePeriodInSecs to force a bunch of older cold data to roll to frozen. I've got plenty of space in frozen.
Is there a way I can get an idea of how much cold volume space I can reclaim if I know how much I want to reduce frozenTimePeriodInSecs?

Tags (1)
0 Karma
1 Solution

jrodman
Splunk Employee
Splunk Employee

By using dir or ls or the dbinspect command, you can find out the bucket time ranges. By seeing how many's "latest" edge, which is typically the edge closest to now, you can see how many would fall outside your retention window if you adjusted frozenTimePeriodInSecs.

As far as i know, dbinspect is not properly distributed so you might have to log into indexers, or if you're using a cluster you could hit the cluster bukets endpoint to get xml or json to walk.

ASIDE:
This is all terribly manual of course. We need to build a tool that can address this type of usecase. Specifically "If i changed my configuration like so.... what would happen?" I hope to work on something like this within the next year or so. As for a GUI with nice visualization I have no idea but please file ERs if the lack is a serious issue for you.

View solution in original post

0 Karma

jrodman
Splunk Employee
Splunk Employee

By using dir or ls or the dbinspect command, you can find out the bucket time ranges. By seeing how many's "latest" edge, which is typically the edge closest to now, you can see how many would fall outside your retention window if you adjusted frozenTimePeriodInSecs.

As far as i know, dbinspect is not properly distributed so you might have to log into indexers, or if you're using a cluster you could hit the cluster bukets endpoint to get xml or json to walk.

ASIDE:
This is all terribly manual of course. We need to build a tool that can address this type of usecase. Specifically "If i changed my configuration like so.... what would happen?" I hope to work on something like this within the next year or so. As for a GUI with nice visualization I have no idea but please file ERs if the lack is a serious issue for you.

0 Karma

somesoni2
Revered Legend
0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...