Deployment Architecture

How can I track when a bucket gets frozen?

andrewtrobec
Builder

Hello!

I am trying to find a way to track when an index bucket rolls to Frozen. I've found the HotBucketRoller component in the _internal index that allows me to tell when a bucket moves from hot to warm, so I'm hoping there's some way to do the same when it moves to frozen.

Is there any way?

Thank you!

Andrew

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @andrewtrobec,

You're looking for the component=BucketMover which will show you all movements into frozen.

Cheers,
David

View solution in original post

amankhan1
Path Finder

This works for me.

index=_internal sourcetype=splunkd log_level=INFO component=BucketMover "freeze succeeded"

andrewtrobec
Builder

@amankhan1 Excellent, thank you. We settled for index=_internal sourcetype=splunkd component=BucketMover but yours adds a couple more filters to be sure.

0 Karma

DavidHourani
Super Champion

Looks good ! The more specific the query is, the faster it will run 🙂

0 Karma

andrewtrobec
Builder

@DavidHourani noted as well!

0 Karma

DavidHourani
Super Champion

Hi @andrewtrobec,

You're looking for the component=BucketMover which will show you all movements into frozen.

Cheers,
David

View solution in original post

andrewtrobec
Builder

Perfect! Thank you!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!