Splunk Search

Splunk query to find amount of data purged based on retention

nmohammed
Builder

We know the amount of data ingested daily from the Splunk internal logs and the License dashboard, but we're trying to find if there's a way to find the amount of data purged on daily based on the our data retention policy. 

Appreciate any help on this. 

Labels (1)
0 Karma

nmohammed
Builder

Thanks @isoutamo 

But how do I search logs related the frozen buckets or purged data?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

with quick look I couldn't found any information how much in KB based there are purged buckets.

Anyhow You could see how many buckets have frozen, but as you couldn't know (at least easily) size of those individual buckets you couldn't count the amount as KB.

Of course you could create app (or try to find that), which keep track of size of individual buckets and based on that information calculate that sum based on frozen buckets. If I recall right, you can get this information, at least on indexer clusters (I haven't now any cluster to check this).

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...