I am assuming you are including "dedup title" on the search with "rest /services/admin/cacheman" as S3 keeps only a single copy of the buckets.
Meanwhile, the cm:bucket.estimated_size is the actual bucket size and there is no guarantee that the local storage would have all of it as buckets could have been evicted. Alternatively, adding the bucket size across all deduped buckets will give you the total S3 storage use.
|rest /services/admin/cacheman | dedup title | stats sum(cm:bucket.estimated_size) AS remoteDiskSize | eval remoteDiskSizeGB = round(remoteDiskSize / 1024 / 1024 / 1024, 2)
If you are still seeing the cm:bucket.status as local means there might be some files left out on that bucket like bucket_info.csv or Hosts.data or Sources.data etc.,
Try evicting the bucket using the following command.
splunk _internal call /services/admin/cacheman/"bid|index-name~id~guid|"/evict -method POST -auth un:pwd
Replace index-name, id and guid as follows.
If the bucket you wanted to evict under an index named apache is db_1572849480_1572840108_19_9A1BE399-F73B-4F0B-83E4-43F7959E3710 invoke as follows.
splunk _internal call /services/admin/cacheman/"bid|apache~19~9A1BE399-F73B-4F0B-83E4-43F7959E3710|"/evict -method POST
... View more