Getting Data In

How to total the buckets that will roll from cold to frozen when changing frozenTimePeriodinSecs

wardallen
Path Finder

I'm running out of space in my cold bucket volume, and want to reduce the default frozenTimePeriodInSecs to force a bunch of older cold data to roll to frozen. I've got plenty of space in frozen.
Is there a way I can get an idea of how much cold volume space I can reclaim if I know how much I want to reduce frozenTimePeriodInSecs?

Tags (1)
0 Karma
1 Solution

jrodman
Splunk Employee
Splunk Employee

By using dir or ls or the dbinspect command, you can find out the bucket time ranges. By seeing how many's "latest" edge, which is typically the edge closest to now, you can see how many would fall outside your retention window if you adjusted frozenTimePeriodInSecs.

As far as i know, dbinspect is not properly distributed so you might have to log into indexers, or if you're using a cluster you could hit the cluster bukets endpoint to get xml or json to walk.

ASIDE:
This is all terribly manual of course. We need to build a tool that can address this type of usecase. Specifically "If i changed my configuration like so.... what would happen?" I hope to work on something like this within the next year or so. As for a GUI with nice visualization I have no idea but please file ERs if the lack is a serious issue for you.

View solution in original post

0 Karma

jrodman
Splunk Employee
Splunk Employee

By using dir or ls or the dbinspect command, you can find out the bucket time ranges. By seeing how many's "latest" edge, which is typically the edge closest to now, you can see how many would fall outside your retention window if you adjusted frozenTimePeriodInSecs.

As far as i know, dbinspect is not properly distributed so you might have to log into indexers, or if you're using a cluster you could hit the cluster bukets endpoint to get xml or json to walk.

ASIDE:
This is all terribly manual of course. We need to build a tool that can address this type of usecase. Specifically "If i changed my configuration like so.... what would happen?" I hope to work on something like this within the next year or so. As for a GUI with nice visualization I have no idea but please file ERs if the lack is a serious issue for you.

0 Karma

somesoni2
Revered Legend
0 Karma
Get Updates on the Splunk Community!

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...