What are the reasons for buckets with name duplicate-* in splunk indexer cluster?

[renjith_nair]

We have recently changed the index path for an indexer node to add additional disk and currently experiencing an issue with duplicate buckets created in indexer cluster.

Steps performed

• Offline the node
• Move the data from old directory to new directory
• Changed the path in indexes.conf to point to the new directory
• Started up node.

The hot an warm buckets are in one directory/path and cold buckets are on another path. Currently we have buckets with name duplicate-rb-* in colddb (only). Tried removing the duplicate bucket and restarted node, but it's still the same. How do we get rid of the duplicates since it's consuming considerable amount of space?

Configuration

multisite=true
site_replication_factor = origin:1,total:2
replication_factor = 2
Two nodes on each site.

Verified few buckets manually and the raw data seems to be same in original as well as in duplicate. So it does not seem to be an bucket id generation issue.

[renjith_nair · Accepted solution]

The reason for the issue was a configuration conflict where thawed path and cold path was pointing to the same directory irrespective of not having any content under thawed path. Soft links have added more complication to resolution. Thought of mentioning it in case somebody faces the same issue.