Splunk Search
Highlighted

Index data volume for logs older than a year

Contributor

Hi,

Can someone tell me how to run a query that will return the size (MB) of total index volume for all logs that are older than a year? I'd like to plan to modify my retention policy to keep logs for 1 year before removing from the index.

Let me know.

Thanks.

Brian

Tags (3)
0 Karma
Highlighted

Re: Index data volume for logs older than a year

SplunkTrust
SplunkTrust

Run this search:

index=_internal source=*metrics.log group=per_index_thruput series!=_* | eval totalGB = (kb/1024)/1024 | stats sum(totalGB)

And choose from the time drop down "Previous Year" or choose "Custom Time" and click "earliest date" then set the appropriate date to search up until. This will give you a total of the GB indexed.

0 Karma
Highlighted

Re: Index data volume for logs older than a year

Contributor

Thanks for the tip Josh. However, this produced no results for me. Anything else I might be able to try? I know for sure I have data older than a year.

0 Karma
Highlighted

Re: Index data volume for logs older than a year

SplunkTrust
SplunkTrust

There should be no issue with this search.. can you run the search over a recent period of time to make sure it returns some results? Just to verify it's indexing the internal metric properly.

Take a peak at my blog post for some relevant searches that may be of assistance:

http://www.joshd.ca/content/splunk-usage-statistic-searches

0 Karma