Splunk Enterprise

How can I determine the cumulative size of buckets rolling to cold?


I have a need to determine, over time, the total size of the buckets rolling to cold regardless of which index. What I think I would like to show is a simple timechart by hour or minute. I've been looking for examples to ride other folks coattails and looked at what is in the metrics log but have not found anything useful yet. Has anyone done this and could you give me a hand? Thank You.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!