Query - to get actual rentention period set & remaining days left for rentention

[splunker12er]

Splunk query to get ,

Actual retention set for an index
Remaining days left to meet retention date
Current Index_size

[datasearchninja]

The retention set for an index on each indexer is available at this rest endpoint:

| rest /services/data/indexes/INDEXNAME

dbinspect can look at each bucket and show the endEpoch, rawsize, and size on disk for each bucket

| dbinspect index=INDEXNAME 

The 2 could be put together to print out the expiry date with something like this. (This example for the os index)

| dbinspect index=os | table splunk_server bucketId endEpoch rawSize sizeOnDiskMB | join splunk_server [rest /services/data/indexes/os | fields splunk_server frozenTimePeriodInSecs] | eval frozentime=endEpoch+frozenTimePeriodInSecs | sort frozentime | convert TIMEFORMAT="%Y-%m-%d %H:%M:%S" ctime(frozentime) as frozentime

The total index size is also at the index rest endpoint, or you could sum the bucket counts.