Hmm, try this for indexes: | rest /services/admin/indexes | eval yr = floor(frozenTimePeriodInSecs/86400/365)| eval dy = (frozenTimePeriodInSecs/86400) % 365 | eval ret = yr . " years, " . dy . " days" | stats list(splunk_server) list(frozenTimePeriodInSecs) list(ret) by title And this for buckets: | dbinspect index=* | join index [|rest /services/data/indexes| eval index=title | table index frozenTimePeriodInSecs ] | eval toNow=now()-endEpoch | convert num(toNow) | convert num(frozenTimePeriodInSecs) | convert ctime(endEpoch) AS endEvent | convert ctime(startEpoch) AS startEvent | eval shouldBeFrozen=if( ( state!="hot" AND state!="thawed" ) AND toNow>frozenTimePeriodInSecs,"yes","no") | table index path id state startEvent endEvent shouldBeFrozen toNow frozenTimePeriodInSecs ... View more

I find the answer for above question In splunk documentation they need to remove that topic for 6.4+, since that content has now been entirely replaced by Distributed Management Console dashboards: http://docs.splunk.com/Documentation/Splunk/6.4.3/DMC/DMCoverview We can view DMC dashboards on an individual instance, just like the old default dashboards. Here is a sample of information available in the DMC dashboards: http://docs.splunk.com/Documentation/Splunk/6.4.3/DMC/WhatcanDMCdo If you go through the (nontrivial) setup steps for a deployment, you can use one instance to view information for all instances in your deployment. http://docs.splunk.com/Documentation/Splunk/6.4.3/DMC/Deploymentsetupsteps ... View more