Splunk Search

Splunk query to find amount of data purged based on retention

nmohammed
Builder

We know the amount of data ingested daily from the Splunk internal logs and the License dashboard, but we're trying to find if there's a way to find the amount of data purged on daily based on the our data retention policy. 

Appreciate any help on this. 

Labels (1)
0 Karma

nmohammed
Builder

Thanks @isoutamo 

But how do I search logs related the frozen buckets or purged data?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

with quick look I couldn't found any information how much in KB based there are purged buckets.

Anyhow You could see how many buckets have frozen, but as you couldn't know (at least easily) size of those individual buckets you couldn't count the amount as KB.

Of course you could create app (or try to find that), which keep track of size of individual buckets and based on that information calculate that sum based on frozen buckets. If I recall right, you can get this information, at least on indexer clusters (I haven't now any cluster to check this).

r. Ismo

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...