How to total the buckets that will roll from cold to frozen when changing frozenTimePeriodinSecs

[wardallen]

I'm running out of space in my cold bucket volume, and want to reduce the default frozenTimePeriodInSecs to force a bunch of older cold data to roll to frozen. I've got plenty of space in frozen.
Is there a way I can get an idea of how much cold volume space I can reclaim if I know how much I want to reduce frozenTimePeriodInSecs?

[jrodman · Accepted solution]

By using dir or ls or the dbinspect command, you can find out the bucket time ranges. By seeing how many's "latest" edge, which is typically the edge closest to now, you can see how many would fall outside your retention window if you adjusted frozenTimePeriodInSecs.

As far as i know, dbinspect is not properly distributed so you might have to log into indexers, or if you're using a cluster you could hit the cluster bukets endpoint to get xml or json to walk.

ASIDE:
This is all terribly manual of course. We need to build a tool that can address this type of usecase. Specifically "If i changed my configuration like so.... what would happen?" I hope to work on something like this within the next year or so. As for a GUI with nice visualization I have no idea but please file ERs if the lack is a serious issue for you.

[somesoni2]

Take a look at this page.

http://wiki.splunk.com/Deploy:BucketRotationAndRetention