Deployment Architecture

Search on most recent data has completed. Expect slower search speeds as we search the reduced bucket

phil_wong
Explorer

What's the meaning of this warning message?

I didn't enable index reduction at all.

"Search on most recent data has completed. Expect slower search speeds as we search the reduced buckets."


Labels (2)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Has this been happening for a while?  If no one explicitly enabled tsidx reduction then the only way this should happen is if an indexer cluster has to search a non-searchable replicated bucket because there are no available searchable replicates.

Check your settings using btool.

splunk btool -debug indexes list | grep TsidxReduction

Check for existing reduced buckets

| dbinspect index=* 
| where NOT tsidxState="full"
| fields index tsidxState
---
If this reply helps you, Karma would be appreciated.
0 Karma

phil_wong
Explorer

Thanks,

The index I concerned got timePeriodInSecBeforeTsidxReduction = 604800 but enableTsidxReduction is not enabled.

The result of running dbinspect tsidxState is full

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You may want to submit a support request.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...