Solved: Detect archive job

syamaguchi3 · ‎10-20-2021

Hi

I configured an archiving policy and I would like to notice when logs are archived. Is there any way to do so? I guess if an archive job is logged as system log, I can detect it in _internal index.

Thank you

richgalloway · ‎10-20-2021

Yes, the _internal log is your friend in this case. This search should get you started. Note that Splunk freezes/archives buckets rather than logs. Any given log file may be in multiple buckets and a bucket may contain data from multiple sources. It depends on your configuration.

index=_internal BucketMover component=BucketMover "freeze succeeded"

---
If this reply helps you, Karma would be appreciated.

View solution in original post

syamaguchi3 · ‎10-21-2021

Thank you!

richgalloway · ‎10-20-2021

Yes, the _internal log is your friend in this case. This search should get you started. Note that Splunk freezes/archives buckets rather than logs. Any given log file may be in multiple buckets and a bucket may contain data from multiple sources. It depends on your configuration.

index=_internal BucketMover component=BucketMover "freeze succeeded"

---
If this reply helps you, Karma would be appreciated.

Detect archive job

indexer

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Join the Conversation