Getting Data In

Query - to get actual rentention period set & remaining days left for rentention

splunker12er
Motivator

Splunk query to get ,

Actual retention set for an index
Remaining days left to meet retention date
Current Index_size

0 Karma

datasearchninja
Communicator

The retention set for an index on each indexer is available at this rest endpoint:

| rest /services/data/indexes/INDEXNAME

dbinspect can look at each bucket and show the endEpoch, rawsize, and size on disk for each bucket

| dbinspect index=INDEXNAME 

The 2 could be put together to print out the expiry date with something like this. (This example for the os index)

| dbinspect index=os | table splunk_server bucketId endEpoch rawSize sizeOnDiskMB | join splunk_server [rest /services/data/indexes/os | fields splunk_server frozenTimePeriodInSecs] | eval frozentime=endEpoch+frozenTimePeriodInSecs | sort frozentime | convert TIMEFORMAT="%Y-%m-%d %H:%M:%S" ctime(frozentime) as frozentime

The total index size is also at the index rest endpoint, or you could sum the bucket counts.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...