https://community.splunk.com/t5/Knowledge-Management/Help-why-it-deletes-buckets/m-p/382706#M6159 <P>Don't panic! Splunk is not actually deleting buckets but it is quite misleading. The bucket information in the CM will be removed while the buckets are there physically on the indexers file system. This is typically happening when the indexers get rolling restarted.</P> Mon, 20 May 2019 22:04:02 GMT sylim_splunk 2019-05-20T22:04:02Z https://community.splunk.com/t5/Knowledge-Management/Help-why-it-deletes-buckets/m-p/382705#M6158 <P>I'm getting a lot of messages like below, Splunk is deleting buckets from time to time.</P> <P>04-25-2019 11:51:02.387 +0200 WARN CMMaster - event=removePeerBuckets peer=FA5BC9C-988E08E40-84BB-12345B2345BA peer_name=splunk-indexer-1 bid=_internal~123~CA5BC8Z-A88E08E40-84BB-A2345B2345FF msg="Bucket is not on any other peer! Removing it."</P> Wed, 30 Sep 2020 00:38:31 GMT https://community.splunk.com/t5/Knowledge-Management/Help-why-it-deletes-buckets/m-p/382705#M6158 sylim_splunk 2020-09-30T00:38:31Z https://community.splunk.com/t5/Knowledge-Management/Help-why-it-deletes-buckets/m-p/382706#M6159 <P>Don't panic! Splunk is not actually deleting buckets but it is quite misleading. The bucket information in the CM will be removed while the buckets are there physically on the indexers file system. This is typically happening when the indexers get rolling restarted.</P> Mon, 20 May 2019 22:04:02 GMT https://community.splunk.com/t5/Knowledge-Management/Help-why-it-deletes-buckets/m-p/382706#M6159 sylim_splunk 2019-05-20T22:04:02Z