Solved: Re: Detect archive job

syamaguchi3 · ‎10-20-2021

Hi

I configured an archiving policy and I would like to notice when logs are archived. Is there any way to do so? I guess if an archive job is logged as system log, I can detect it in _internal index.

Thank you

richgalloway · ‎10-20-2021

Yes, the _internal log is your friend in this case. This search should get you started. Note that Splunk freezes/archives buckets rather than logs. Any given log file may be in multiple buckets and a bucket may contain data from multiple sources. It depends on your configuration.

index=_internal BucketMover component=BucketMover "freeze succeeded"

---
If this reply helps you, Karma would be appreciated.

View solution in original post

syamaguchi3 · ‎10-21-2021

Thank you!

richgalloway · ‎10-20-2021

Yes, the _internal log is your friend in this case. This search should get you started. Note that Splunk freezes/archives buckets rather than logs. Any given log file may be in multiple buckets and a bucket may contain data from multiple sources. It depends on your configuration.

index=_internal BucketMover component=BucketMover "freeze succeeded"

---
If this reply helps you, Karma would be appreciated.

Detect archive job

indexer

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Free Professional Services for .conf26 Attendees

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

Join the Conversation