Hello,
I've found this doc: http://docs.splunk.com/Documentation/Splunk/6.2.3/RESTREF/RESTintrospectExamples and indexes-extended looks interesting, but bucket_dirs.cold.event_max_time doesn't seem to provide valid information if it's in seconds 1473743863 (17057 days!)
I think it's possible to evaluate home and cold real data retention stats, however, for the frozen, maybe I would need to manually check system files as this location may not monitored?
Thanks for your help.
↧
How to get home (hot/warm), cold, and frozen effective indexes' data retention / stats using REST?
↧