https://community.splunk.com/t5/Getting-Data-In/1-out-of-2-indexer-has-high-RAM-utilisation/m-p/390437#M69857 <P>After out upgrade from 6.5 to 7.2 1 of 2 indexers has high ram utilisation. We are running Enterprise Security too.</P> <P>Health Status from the search head is showing a yellow for splunkd - data forwarding (I assume to that indexer?)</P> <P>Health status on that indexer is showing a Red for buckets.</P> <P>The percentage of small of buckets created (60) over the last hour is very high and exceeded the red thresholds (50) for index=app_logs, and possibly more indexes, on this indexer</P> <P>So I'm not sure why its creating lots of small buckets - is this related to how we setup inputs?</P> Mon, 12 Nov 2018 02:43:33 GMT mjm295 2018-11-12T02:43:33Z https://community.splunk.com/t5/Getting-Data-In/1-out-of-2-indexer-has-high-RAM-utilisation/m-p/390437#M69857 <P>After out upgrade from 6.5 to 7.2 1 of 2 indexers has high ram utilisation. We are running Enterprise Security too.</P> <P>Health Status from the search head is showing a yellow for splunkd - data forwarding (I assume to that indexer?)</P> <P>Health status on that indexer is showing a Red for buckets.</P> <P>The percentage of small of buckets created (60) over the last hour is very high and exceeded the red thresholds (50) for index=app_logs, and possibly more indexes, on this indexer</P> <P>So I'm not sure why its creating lots of small buckets - is this related to how we setup inputs?</P> Mon, 12 Nov 2018 02:43:33 GMT https://community.splunk.com/t5/Getting-Data-In/1-out-of-2-indexer-has-high-RAM-utilisation/m-p/390437#M69857 mjm295 2018-11-12T02:43:33Z https://community.splunk.com/t5/Getting-Data-In/1-out-of-2-indexer-has-high-RAM-utilisation/m-p/390438#M69858 <P>indexes.conf for the bucket:</P> <P>[app_logs]<BR /> homePath = $SPLUNK_DB/app_logs/db<BR /> coldPath = $SPLUNK_DB/app_logs/colddb<BR /> thawedPath = $SPLUNK_DB/app_logs/thaweddb<BR /> frozenTimePeriodInSecs = 31557600<BR /> disabled = 0</P> Tue, 29 Sep 2020 22:02:32 GMT https://community.splunk.com/t5/Getting-Data-In/1-out-of-2-indexer-has-high-RAM-utilisation/m-p/390438#M69858 mjm295 2020-09-29T22:02:32Z