How can I track when a bucket gets frozen?

[andrewtrobec]

Hello!

I am trying to find a way to track when an index bucket rolls to Frozen. I've found the HotBucketRoller component in the _internal index that allows me to tell when a bucket moves from hot to warm, so I'm hoping there's some way to do the same when it moves to frozen.

Is there any way?

Thank you!

Andrew

[amankhan1]

This works for me.

index=_internal sourcetype=splunkd log_level=INFO component=BucketMover "freeze succeeded"

[andrewtrobec]

@amankhan1 Excellent, thank you. We settled for index=_internal sourcetype=splunkd component=BucketMover but yours adds a couple more filters to be sure.

[DavidHourani]

Looks good ! The more specific the query is, the faster it will run 🙂

[andrewtrobec]

@DavidHourani noted as well!

[DavidHourani · Accepted solution]

Hi @andrewtrobec,

You're looking for the component=BucketMover which will show you all movements into frozen.

Cheers,
David

[andrewtrobec]

Perfect! Thank you!