I see this message quite often -
throttled: idx=<index name> Throttling indexer, too many tsidx files in bucket='/SplunkIndexData/splunk-indexes/<index name>/db/hot_v1_2094'. Is splunk-optimize working? If not, low disk space may be the cause.
What should I do?
Depending on your version of Splunk, there is/was a bug that was fixed in version 6.6.7 where clustering was generating too many buckets erroneously:
It was also fixed in version 7.0.3 and 7.1.0:
Are your Indexers clustered?
Maybe this is what is going on?
View solution in original post
Interesting - we are with 6.5.2. and right, our indexers are clustered.
A related thread at Indexing throttled due to "too many tsidx files" - Is splunk-optimize working?