Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to monitor data retention policy and tweak accordingly.

$
0
0
I've searched but havent yet been able to find the answer. We have a clustered index setup, and lots of data going into different indexes. We have the indexes defined with `frozenTimePeriodInSecs ` and `maxTotalDataSizeMB ` I'd like to produce a dashboard if one doesnt already exist to answer the following questions: 1. What is the oldest data in each index? eg its 183 days old 2. How much of the total allotted space is each index using for its hot and cold stores.: eg 98% of Hot and 15% of Cold is being used for this index. 3. How much of the physical disks have we allocated to indexes. For example if all indexes were full, have we allocated 150% of the physical space available? All indexes sit on a HOT disk and a COLD disk. Eg 98% of hot disk is allocated, 150% of cold disk space is allocated 4. At the current rate of ingestion, what would the retention be if we used 100% of all allocated space available for the index. eg 360 days 5. What is limiting our retention - is it our maxTotalDataSizeMB or frozenTimePeriodInSecs for each index. Thanks for your help.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>