Could someone provide some insight on how to fix Splunk bucket errors in panels?

[_pravin]

Hi Community,

When the panels are loaded in dashboards, I find this error as an exclamation in the panel.

I initially thought the error was due to the permission and granted all the folders access, but still the issue exists.

Not sure what is the issue, could someone provide me some insights on how to fix the issue?

Regards,

Pravin

[scelikok]

Hİ @_pravin,

Higher versions may need more resources in some cases but it is not easy what causes problems on your indexers. You can check on monitoring console Resource Usage for indexers. You can see which processes are using most of the resources. 

[scelikok]

Hi @_pravin,

It is a warning about low disk performance on indexer3. Either that indexer is too busy or your filesystem cannot provide enough IOPS. If your indexers are running on shared storage this may show the bottleneck. 

You should better check your filesystem performance.

[_pravin]

Hi @scelikok ,

Your answer was informative but doesn't fix my issue. All I can conclude was that this is not to do with the version of Splunk but rather the underlying hardware.

I also can't find a single process that is overutilizing the resource. Please feel free to share more information if you come across similar issues.

Thanks,

Pravin

[_pravin]

Hi @scelikok ,

Thanks for getting back. I started getting these errors only after I started migrating the test environment back and forth to the 9.0.2 and 8.1.0 versions. Earlier I never used to get such errors.

This is the same environment that used to work properly in the 8.1.0 version but now that I have migrated to 9.0.2 and reverted changes back, even 8.1.0 shows these errors.

Also, this is not just for one indexer but for all the ones in the indexer cluster.

So what I would like to know is that does the upgrade take a dig at the filesystem performance or does this make the system busier than the previous versions when compared to 8.x versions.

Regards,

Pravin