Deployment Architecture

How can I track when a bucket gets frozen?

andrewtrobec
Motivator

Hello!

I am trying to find a way to track when an index bucket rolls to Frozen. I've found the HotBucketRoller component in the _internal index that allows me to tell when a bucket moves from hot to warm, so I'm hoping there's some way to do the same when it moves to frozen.

Is there any way?

Thank you!

Andrew

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @andrewtrobec,

You're looking for the component=BucketMover which will show you all movements into frozen.

Cheers,
David

View solution in original post

amankhan1
Path Finder

This works for me.

index=_internal sourcetype=splunkd log_level=INFO component=BucketMover "freeze succeeded"

andrewtrobec
Motivator

@amankhan1 Excellent, thank you. We settled for index=_internal sourcetype=splunkd component=BucketMover but yours adds a couple more filters to be sure.

0 Karma

DavidHourani
Super Champion

Looks good ! The more specific the query is, the faster it will run 🙂

0 Karma

andrewtrobec
Motivator

@DavidHourani noted as well!

0 Karma

DavidHourani
Super Champion

Hi @andrewtrobec,

You're looking for the component=BucketMover which will show you all movements into frozen.

Cheers,
David

andrewtrobec
Motivator

Perfect! Thank you!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...