Splunk Search

Splunk query to find amount of data purged based on retention

nmohammed
Contributor

We know the amount of data ingested daily from the Splunk internal logs and the License dashboard, but we're trying to find if there's a way to find the amount of data purged on daily based on the our data retention policy. 

Appreciate any help on this. 

Labels (2)
0 Karma

nmohammed
Contributor

Thanks @isoutamo 

But how do I search logs related the frozen buckets or purged data?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

with quick look I couldn't found any information how much in KB based there are purged buckets.

Anyhow You could see how many buckets have frozen, but as you couldn't know (at least easily) size of those individual buckets you couldn't count the amount as KB.

Of course you could create app (or try to find that), which keep track of size of individual buckets and based on that information calculate that sum based on frozen buckets. If I recall right, you can get this information, at least on indexer clusters (I haven't now any cluster to check this).

r. Ismo

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!