index=_internal sourcetype=splunkd earliest=-7d latest=now component=BucketMover | rex field=bkt "/opt/splunk/var/lib/splunk/cold(?<frozen_index>[^/]+)" | stats count by frozen_index
0 comments