Deployment Architecture

Does Splunk log deleted buckets?

cboillot
Contributor

We have just discovered that we have lost a large amount of data. Does Splunk log when it deletes buckets? I found this question that references SPLUNK_HOME/var/log/splunk/splunkd_stdout.log, but I do not see that file on v7.0.2.

Is this something I have to turn on? Was it moved? Is there a better way?

0 Karma

gjanders
SplunkTrust
SplunkTrust

In Alerts for Splunk Admins (splunkbase) or github version, I have alerts such as "IndexerLevel - Buckets are been frozen due to index sizing"

index=_internal sourcetype=splunkd source=*splunkd.log "BucketMover - will attempt to freeze" NOT "because frozenTimePeriodInSecs=" 
| rex field=bkt "(rb_|db_)(?P<newestDataInBucket>\d+)_(?P<oldestDataInBucket>\d+)"
| eval newestDataInBucket=strftime(newestDataInBucket, "%+"), oldestDataInBucket = strftime(oldestDataInBucket, "%+") 
| table message, oldestDataInBucket, newestDataInBucket

Will ignore those that were frozen due to timestamp, or you could tweak that further to include those as well

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...