What can I do in a Throttling indexer, too many tsidx files in bucket, situation?

[ddrillic]

I see this message quite often -

throttled: idx=<index name> Throttling indexer, too many tsidx files in bucket='/SplunkIndexData/splunk-indexes/<index name>/db/hot_v1_2094'. Is splunk-optimize working? If not, low disk space may be the cause. 

What should I do?

[pdaigle_splunk · Accepted solution]

Depending on your version of Splunk, there is/was a bug that was fixed in version 6.6.7 where clustering was generating too many buckets erroneously:

http://docs.splunk.com/Documentation/Splunk/6.6.8/ReleaseNotes/6.6.7

It was also fixed in version 7.0.3 and 7.1.0:

http://docs.splunk.com/Documentation/Splunk/7.0.3/ReleaseNotes/Fixedissues

http://docs.splunk.com/Documentation/Splunk/7.1.0/ReleaseNotes/Fixedissues

Are your Indexers clustered?

Maybe this is what is going on?

[ddrillic]

Interesting - we are with 6.5.2. and right, our indexers are clustered.

A related thread at Indexing throttled due to "too many tsidx files" - Is splunk-optimize working?