Index data volume for logs older than a year

[balbano]

Hi,

Can someone tell me how to run a query that will return the size (MB) of total index volume for all logs that are older than a year? I'd like to plan to modify my retention policy to keep logs for 1 year before removing from the index.

Let me know.

Thanks.

Brian

[joshd]

Run this search:

index=_internal source=*metrics.log group=per_index_thruput series!=_* | eval totalGB = (kb/1024)/1024 | stats sum(totalGB)

And choose from the time drop down "Previous Year" or choose "Custom Time" and click "earliest date" then set the appropriate date to search up until. This will give you a total of the GB indexed.

[joshd]

There should be no issue with this search.. can you run the search over a recent period of time to make sure it returns some results? Just to verify it's indexing the internal metric properly.

Take a peak at my blog post for some relevant searches that may be of assistance:

http://www.joshd.ca/content/splunk-usage-statistic-searches

[balbano]

Thanks for the tip Josh. However, this produced no results for me. Anything else I might be able to try? I know for sure I have data older than a year.