Roll buckets that are in "Cannot fix search count as the bucket hasn't rolled yet" state

[alonsocaio]

Is there any way to automatically roll buckets that are in the "Cannot fix search count as the bucket hasn't rolled yet" state? Every time that any of my indexers restarts It causes some buckets to stay in fixing mode because they have not rolled yet.

This is causing some impact my Enterprise Security performance, since some of the correlation searches will not run when I have lots of buckets in fixing mode.

[codebuilder · Accepted solution]

You can manually roll all hot buckets from hot to warm at the index level:

splunk _internal call /data/indexes/<index_name>/roll-hot-buckets -auth <admin_username>:<admin_password>

[alonsocaio]

Thanks, I guess that this will help me!

[muizash]

Where to run this command?

[codebuilder]

On the indexers.