Search on most recent data has completed. Expect slower search speeds as we search the reduced bucket

[phil_wong]

What's the meaning of this warning message?

I didn't enable index reduction at all.

"Search on most recent data has completed. Expect slower search speeds as we search the reduced buckets."

[richgalloway]

Has this been happening for a while?  If no one explicitly enabled tsidx reduction then the only way this should happen is if an indexer cluster has to search a non-searchable replicated bucket because there are no available searchable replicates.

Check your settings using btool.

splunk btool -debug indexes list | grep TsidxReduction

Check for existing reduced buckets

| dbinspect index=* 
| where NOT tsidxState="full"
| fields index tsidxState

[phil_wong]

Thanks,

The index I concerned got timePeriodInSecBeforeTsidxReduction = 604800 but enableTsidxReduction is not enabled.

The result of running dbinspect tsidxState is full

[richgalloway]

You may want to submit a support request.