Look in the _internal index like so;
index=_internal sourcetype=splunkd component=BucketMover
and you'll see some events looking like this
10-07-2013 20:55:59.803 +0200 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='C:\Program Files\Splunk\var\lib\splunk\_internaldb\db\db_1378752950_1378278490_56'
Hope this helps,
K
In a clustered environment it will be slightly different;
index=_internal sourcetype=splunkd component=BucketMover "RemoteStorageAsyncFreezer freeze completed succesfully"
(and yes, at least as of spunk 7.0.3.8 it is spelled incorrectly in the logs)
08-21-2018 14:42:09.186 +0000 INFO BucketMover - RemoteStorageAsyncFreezer freeze completed succesfully for bid=_internal~122~07CFCEF1-588B-4F02-AD1F-8FD284A77955
8-21-2018 14:42:09.172 +0000 INFO BucketMover - RemoteStorageAsyncFreezer trying to freeze bid=_internal~122~07CFCEF1-588B-4F02-AD1F-8FD284A77955, freezeInitiatedByAnotherPeer=true
Look in the _internal index like so;
index=_internal sourcetype=splunkd component=BucketMover
and you'll see some events looking like this
10-07-2013 20:55:59.803 +0200 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='C:\Program Files\Splunk\var\lib\splunk\_internaldb\db\db_1378752950_1378278490_56'
Hope this helps,
K
exactly what i was looking for thank you.