Splunk Search

Splunk query to find amount of data purged based on retention

nmohammed
Builder

We know the amount of data ingested daily from the Splunk internal logs and the License dashboard, but we're trying to find if there's a way to find the amount of data purged on daily based on the our data retention policy. 

Appreciate any help on this. 

Labels (1)
0 Karma

nmohammed
Builder

Thanks @isoutamo 

But how do I search logs related the frozen buckets or purged data?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

with quick look I couldn't found any information how much in KB based there are purged buckets.

Anyhow You could see how many buckets have frozen, but as you couldn't know (at least easily) size of those individual buckets you couldn't count the amount as KB.

Of course you could create app (or try to find that), which keep track of size of individual buckets and based on that information calculate that sum based on frozen buckets. If I recall right, you can get this information, at least on indexer clusters (I haven't now any cluster to check this).

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...