Splunk Tips and Tricks - Detecting Logs Moving to Frozen Bucket
When indexes.conf settings get filled, the logs move to frozen. It may be useful to be able to set an alert for when logs are moved to frozen so one can be alerted when the indexes are starting to fill up instead of manually looking for the capacity of the indexes.
Join this channel to get access to early release of videos and exclusive training videos that will help make you L.A.M.E. ninja: / @lamecreations_guides