Monitor logs during archiving

Splunk generates logs when you archive data and when you restore archived data. You may want to monitor these logs to check for errors during these processes.

Archiving logs

To check for error messages that occur when you are archiving data, you can view the coldstoragearchiver entries in the splunkd.log. You can find these entries by running the following search: 

index=_internal source=*/splunkd.log component=coldstoragearchiver

Data restoration logs

To check for error messages that occur when you restore archived data, you can view entries in the splunk_archiver_restoration.log, restoration.log, and python.log. You can find these entries by running the following search: 

index=_internal source=*/splunk_archiver_restoration.log
index=_internal source=*/restoration.log
index=_internal source=*/python.log