Alerting
Highlighted

Searches to detect buckets going to frozen

Builder

Does anyone have any good searches they use for detecting when data is rolled to frozen? Basically just want to setup an alert that will let me know that I have started to get rid of data.

Thanks

Tags (2)
0 Karma
Highlighted

Re: Searches to detect buckets going to frozen

Ultra Champion

Look in the _internal index like so;

index=_internal sourcetype=splunkd component=BucketMover

and you'll see some events looking like this

10-07-2013 20:55:59.803 +0200 INFO  BucketMover - AsyncFreezer freeze succeeded for bkt='C:\Program Files\Splunk\var\lib\splunk\_internaldb\db\db_1378752950_1378278490_56'

Hope this helps,

K

View solution in original post

Highlighted

Re: Searches to detect buckets going to frozen

Builder

exactly what i was looking for thank you.

0 Karma
Highlighted

Re: Searches to detect buckets going to frozen

Splunk Employee
Splunk Employee

In a clustered environment it will be slightly different;

index=_internal sourcetype=splunkd component=BucketMover "RemoteStorageAsyncFreezer freeze completed succesfully"

(and yes, at least as of spunk 7.0.3.8 it is spelled incorrectly in the logs)

08-21-2018 14:42:09.186 +0000 INFO  BucketMover - RemoteStorageAsyncFreezer freeze completed succesfully for bid=_internal~122~07CFCEF1-588B-4F02-AD1F-8FD284A77955
8-21-2018 14:42:09.172 +0000 INFO  BucketMover - RemoteStorageAsyncFreezer trying to freeze bid=_internal~122~07CFCEF1-588B-4F02-AD1F-8FD284A77955, freezeInitiatedByAnotherPeer=true
0 Karma