topic Re: Splunkd Bucket error in Splunk Enterprise

Splunkd Bucket error

gowtham08091 — Sat, 11 Jul 2020 05:38:04 GMT

Hello,

Recently I been getting Bucket error in index processor everyday. I am rebooting the Splunkd service everyday to get rid of this error.

How to identify the root cause of this issue and fix it.

error attached

Thanks

Re: Splunkd Bucket error

richgalloway — Sat, 11 Jul 2020 12:42:24 GMT

What details do you have about the error?
Click on the red Buckets text to get them. Or check splunkd.log.

Re: Splunkd Bucket error

isoutamo — Sat, 11 Jul 2020 18:28:40 GMT

Can you click item “Bucket” to get the details of error and also look what you can found from internal logs (e.g. index=_internal sourcetype=splunkd bucket)?

r. Ismo

Re: Splunkd Bucket error

gowtham08091 — Mon, 13 Jul 2020 04:04:20 GMT

Hello,

I get a response with one of my index

"Root Cause(s):
The percentage of small of buckets created (100) over the last hour is very high and exceeded the red thresholds (50) for index=jenkins_statistics, and possibly more indexes, on this indexer"

Any idea how to fix this issue.

Re: Splunkd Bucket error

isoutamo — Mon, 13 Jul 2020 08:03:29 GMT

if you don’t use smartstore then you should update your indexes.conf with maxDataSize = auto_high_volume for that index if this behavior is regular.

r. Ismo