Splunk Search

Index data volume for logs older than a year

balbano
Contributor

Hi,

Can someone tell me how to run a query that will return the size (MB) of total index volume for all logs that are older than a year? I'd like to plan to modify my retention policy to keep logs for 1 year before removing from the index.

Let me know.

Thanks.

Brian

Tags (3)
0 Karma

joshd
Builder

Run this search:

index=_internal source=*metrics.log group=per_index_thruput series!=_* | eval totalGB = (kb/1024)/1024 | stats sum(totalGB)

And choose from the time drop down "Previous Year" or choose "Custom Time" and click "earliest date" then set the appropriate date to search up until. This will give you a total of the GB indexed.

0 Karma

joshd
Builder

There should be no issue with this search.. can you run the search over a recent period of time to make sure it returns some results? Just to verify it's indexing the internal metric properly.

Take a peak at my blog post for some relevant searches that may be of assistance:

http://www.joshd.ca/content/splunk-usage-statistic-searches

0 Karma

balbano
Contributor

Thanks for the tip Josh. However, this produced no results for me. Anything else I might be able to try? I know for sure I have data older than a year.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...