https://community.splunk.com/t5/Monitoring-Splunk/Detect-archive-job/m-p/571683#M8647 <P>Hi</P><P>I configured an archiving policy and I would like to notice when logs are archived. Is there any way to do so? I guess if an archive job is logged as system log, I can detect it in _internal index.</P><P>Thank you</P> Wed, 20 Oct 2021 15:28:27 GMT syamaguchi3 2021-10-20T15:28:27Z https://community.splunk.com/t5/Monitoring-Splunk/Detect-archive-job/m-p/571683#M8647 <P>Hi</P><P>I configured an archiving policy and I would like to notice when logs are archived. Is there any way to do so? I guess if an archive job is logged as system log, I can detect it in _internal index.</P><P>Thank you</P> Wed, 20 Oct 2021 15:28:27 GMT https://community.splunk.com/t5/Monitoring-Splunk/Detect-archive-job/m-p/571683#M8647 syamaguchi3 2021-10-20T15:28:27Z https://community.splunk.com/t5/Monitoring-Splunk/Detect-archive-job/m-p/571703#M8650 <P>Yes, the _internal log is your friend in this case.&nbsp; &nbsp;This search should get you started.&nbsp; Note that Splunk freezes/archives buckets rather than logs.&nbsp; Any given log file may be in multiple buckets and a bucket may contain data from multiple sources.&nbsp; It depends on your configuration.</P><LI-CODE lang="markup">index=_internal BucketMover component=BucketMover "freeze succeeded"</LI-CODE><P>&nbsp;</P> Wed, 20 Oct 2021 17:45:27 GMT https://community.splunk.com/t5/Monitoring-Splunk/Detect-archive-job/m-p/571703#M8650 richgalloway 2021-10-20T17:45:27Z https://community.splunk.com/t5/Monitoring-Splunk/Detect-archive-job/m-p/571825#M8651 <P>Thank you!</P> Thu, 21 Oct 2021 13:56:57 GMT https://community.splunk.com/t5/Monitoring-Splunk/Detect-archive-job/m-p/571825#M8651 syamaguchi3 2021-10-21T13:56:57Z