Hello!
I am trying to find a way to track when an index bucket rolls to Frozen. I've found the HotBucketRoller
component in the _internal
index that allows me to tell when a bucket moves from hot to warm, so I'm hoping there's some way to do the same when it moves to frozen.
Is there any way?
Thank you!
Andrew
Hi @andrewtrobec,
You're looking for the component=BucketMover
which will show you all movements into frozen.
Cheers,
David
This works for me.
index=_internal sourcetype=splunkd log_level=INFO component=BucketMover "freeze succeeded"
@amankhan1 Excellent, thank you. We settled for index=_internal sourcetype=splunkd component=BucketMover
but yours adds a couple more filters to be sure.
Looks good ! The more specific the query is, the faster it will run 🙂
@DavidHourani noted as well!
Hi @andrewtrobec,
You're looking for the component=BucketMover
which will show you all movements into frozen.
Cheers,
David
Perfect! Thank you!