Splunk Enterprise

How can I determine the cumulative size of buckets rolling to cold?


I have a need to determine, over time, the total size of the buckets rolling to cold regardless of which index. What I think I would like to show is a simple timechart by hour or minute. I've been looking for examples to ride other folks coattails and looked at what is in the metrics log but have not found anything useful yet. Has anyone done this and could you give me a hand? Thank You.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!