Modify Splunk health checks - The percentage of small buckets created over the last hour is high

[_joe]

Hello all,

Looking for a way to modify the Splunk Health Check for small buckets. Specifically, I would like the healthcheck to exclude certain indexes.

For example, I like knowing if I am getting too many small buckets... but not if it is for my test index.

 Buckets

• Root Cause(s):
  • The percentage of small buckets (100%) created over the last hour is high and exceeded the red thresholds (50%) for index=test, and possibly more indexes, on this indexer. At the time this alert fired, total buckets created=6, small buckets=6
  • The percentage of small buckets (100%) created over the last hour is high and exceeded the red thresholds (50%) for index=test, and possibly more indexes, on this indexer. At the time this alert fired, total buckets created=5, small buckets=5

[richgalloway]

I was looking into this today for a similar problem with a different health check.  It turns out we can adjust the threshold for when the check turns yellow or red, but can't change the check itself.  IOW, the search is hardcoded.