Splunk query to find amount of data purged based on retention

[nmohammed]

We know the amount of data ingested daily from the Splunk internal logs and the License dashboard, but we're trying to find if there's a way to find the amount of data purged on daily based on the our data retention policy. 

Appreciate any help on this. 

[nmohammed]

Thanks @isoutamo 

But how do I search logs related the frozen buckets or purged data?

[isoutamo]

Here is one answer related to this bucket issue.

https://community.splunk.com/t5/Deployment-Architecture/Frozen-Buckets-with-Error-Cannot-replicate-a...

[isoutamo]

Hi

with quick look I couldn't found any information how much in KB based there are purged buckets.

Anyhow You could see how many buckets have frozen, but as you couldn't know (at least easily) size of those individual buckets you couldn't count the amount as KB.

Of course you could create app (or try to find that), which keep track of size of individual buckets and based on that information calculate that sum based on frozen buckets. If I recall right, you can get this information, at least on indexer clusters (I haven't now any cluster to check this).

r. Ismo