topic Re: How can I track when a bucket gets frozen? in Deployment Architecture

How can I track when a bucket gets frozen?

andrewtrobec — Thu, 27 Jun 2019 08:57:36 GMT

Hello!

I am trying to find a way to track when an index bucket rolls to Frozen. I've found the HotBucketRoller component in the _internal index that allows me to tell when a bucket moves from hot to warm, so I'm hoping there's some way to do the same when it moves to frozen.

Is there any way?

Thank you!

Andrew

Re: How can I track when a bucket gets frozen?

DavidHourani — Thu, 27 Jun 2019 09:15:48 GMT

Hi @andrewtrobec,

You're looking for the component=BucketMover which will show you all movements into frozen.

Cheers,
David

Re: How can I track when a bucket gets frozen?

andrewtrobec — Thu, 27 Jun 2019 09:35:43 GMT

Perfect! Thank you!

Re: How can I track when a bucket gets frozen?

amankhan1 — Wed, 30 Sep 2020 03:12:33 GMT

This works for me.

index=_internal sourcetype=splunkd log_level=INFO component=BucketMover "freeze succeeded"

Re: How can I track when a bucket gets frozen?

andrewtrobec — Mon, 09 Dec 2019 14:50:11 GMT

@amankhan1 Excellent, thank you. We settled for index=_internal sourcetype=splunkd component=BucketMover but yours adds a couple more filters to be sure.

Re: How can I track when a bucket gets frozen?

DavidHourani — Mon, 09 Dec 2019 15:00:20 GMT

Looks good ! The more specific the query is, the faster it will run 🙂

Re: How can I track when a bucket gets frozen?

andrewtrobec — Mon, 09 Dec 2019 15:49:07 GMT

@DavidHourani noted as well!