Getting Data In

Query - to get actual rentention period set & remaining days left for rentention


Splunk query to get ,

Actual retention set for an index
Remaining days left to meet retention date
Current Index_size

0 Karma


The retention set for an index on each indexer is available at this rest endpoint:

| rest /services/data/indexes/INDEXNAME

dbinspect can look at each bucket and show the endEpoch, rawsize, and size on disk for each bucket

| dbinspect index=INDEXNAME 

The 2 could be put together to print out the expiry date with something like this. (This example for the os index)

| dbinspect index=os | table splunk_server bucketId endEpoch rawSize sizeOnDiskMB | join splunk_server [rest /services/data/indexes/os | fields splunk_server frozenTimePeriodInSecs] | eval frozentime=endEpoch+frozenTimePeriodInSecs | sort frozentime | convert TIMEFORMAT="%Y-%m-%d %H:%M:%S" ctime(frozentime) as frozentime

The total index size is also at the index rest endpoint, or you could sum the bucket counts.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...