Searches to detect buckets going to frozen

[cramasta]

Does anyone have any good searches they use for detecting when data is rolled to frozen? Basically just want to setup an alert that will let me know that I have started to get rid of data.

Thanks

[twollenslegel_s]

In a clustered environment it will be slightly different;

index=_internal sourcetype=splunkd component=BucketMover "RemoteStorageAsyncFreezer freeze completed succesfully"

(and yes, at least as of spunk 7.0.3.8 it is spelled incorrectly in the logs)

08-21-2018 14:42:09.186 +0000 INFO  BucketMover - RemoteStorageAsyncFreezer freeze completed succesfully for bid=_internal~122~07CFCEF1-588B-4F02-AD1F-8FD284A77955
8-21-2018 14:42:09.172 +0000 INFO  BucketMover - RemoteStorageAsyncFreezer trying to freeze bid=_internal~122~07CFCEF1-588B-4F02-AD1F-8FD284A77955, freezeInitiatedByAnotherPeer=true

[kristian_kolb · Accepted solution]

Look in the _internal index like so;

index=_internal sourcetype=splunkd component=BucketMover

and you'll see some events looking like this

10-07-2013 20:55:59.803 +0200 INFO  BucketMover - AsyncFreezer freeze succeeded for bkt='C:\Program Files\Splunk\var\lib\splunk\_internaldb\db\db_1378752950_1378278490_56'

Hope this helps,

K

[cramasta]

exactly what i was looking for thank you.