Why are we seeing .dat files created in the cold to frozen path?

[athorat]

We started seeing .dat files for all the indexes since 4th of august at the following path: /opt/splunk/var/lib/splunk
This is where the cold to frozen is pointed to.
There are no changes or upgrades on the server. Is anything wrong with the configurations?

[martin_mueller]

These .dat files hold the next bucket ID to be created for that index, and they aren't influenced by homePath etc. settings in indexes.conf... mostly harmless.

[ddrillic]

It seems to be just fine as I see these tiny files as well and they hold numbers. _thefishbucket.dat holds a zero in my case, maybe the number of buckets.. ?

We can see an old refrefence (from 04/03/15) to these *.dat files at Why do I only see the current day's results in searches and should all files in /opt/splunk/var/lib/...

It says -

-- I'm a total splunk newbie, and I inherited a splunk server running on Red Hat Enterprise Linux 5. The other day, I did a reboot of the system. Since then, I can only view the current day's data when I run a search. The version of splunk is 5.0.9. Build 213964 Platform linux x86_64. The splunkd service is running as root, but when I look in /opt/splunk/var/lib/splunk, I see that all the files except for the ones ending in .dat are owned by splunk:splunk. The .dat files are owned by root:root. Should they all be owned by root?