Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Frozen script - deletes older than 12 months data

$
0
0
Hello guys, I've created a shell script, scheduled with cron-like software, which deletes 12+ months data except for one special index (13 months), could someone gives comment on it? Calling method : *./script.sh /var/frozen/ 2* Note : if you use it, at your own risk :) Thanks. #!/bin/bash # Frozen buckets detection #$1 = first arg : main directory #$2 = second arg : depth cd ~ curDateEpo=`date +%s`; curDate=`date -d @$curDateEpo`; beforeDateEpo=`expr $curDateEpo - 31536000` # Special 13 months 10/09/2019 beforeDateEpoSpecial=`expr $curDateEpo - 34165800` #echo "Current Epoch time: $curDateEpo"; #echo $(whoami) #echo "Before 12 months : $beforeDateEpo"; for i in `find $1 -maxdepth $2 -type d` do read latest earliest <<<${i//[^0-9]/ }; earliest=${earliest:0:10} if [[ $earliest =~ ^[0-9]+$ ]] ; then if [ "$earliest" != "" ] then earliestH=`date -d @$earliest +%Y/%m/%d`; # Compare # Case Special (CASE SENSITIVE!!!) if [[ $i == *"ppr_app_special/"* ]] then beforeDateEpo=$beforeDateEpoSpecial printf "***** special detected in $i so applying $beforeDateEpo period *****\n" >> splunk_frozen_script.log; #else #printf "special not detected in $i so applying $beforeDateEpo period\n" >> splunk_frozen_script.log; fi if [ "$earliest" -lt "$beforeDateEpo" ] then # Splunk format #printf "$curDate;$i;$earliestH\n"; ### PURGE ### rm -r $i printf "$curDate;$i;$earliestH;DELETED\n" >> splunk_frozen_script.log; echo "Some buckets have been deleted, logged in splunk_frozen_script.log"; fi fi fi done printf "$curDate;$curDate;EXEC_FINISHED\n" >> splunk_frozen_script.log;

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>