Hi!
I configured my deployment to store frozen buckets. But, now i have only 15% empty in my partition.
I need to delete some buckets. I want to know how to determine age of events in frozen buckets for resolves this problem.
@wmedeiros, you can use dbinspect
command to perform this analysis on volume/age by buckets:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Dbinspect
db_<newest_time>_<oldest_time>_<localid>_<guid>
The times are in UTC epoch.
http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/HowSplunkstoresindexes
Thanks.
I have this bucket "db_1467575622_1467543210_820". I understood that the newest_time=1467575622 and oldest_time=1 467 543 210.
This time are in seconds, but how to transform this time in Date?
1 day has 87400 seconds (24*60*60).
1 year has 31536000 seconds (87400*365)
1467575622 seconds are 46.53 years (1467575622/31536000)
How to determine the age of these events ?
Those are epoch time, please use https://www.epochconverter.com/ to convert epoch time to human readable format.