All,
I have an index (index=config) where all I store are the sourcetype=config_file. I currently use the stock config from Splunk_TA_nix.
What I am thinking is happening is that when we provision new server the config_files are often dated in years old so Splunk is creating new bucked dated years old. Is that reasonable assumption?
Looking at btool I am thinking all I need to do is set MAX_DAYS_AGO = 1 from 2000.
Here is the error message I am seeing The percentage of small buckets (100%) created over the last hour is high and exceeded the red thresholds (50%) for index=configs, and possibly more indexes, on this indexer. At the time this alert fired, total buckets created=4, small buckets=4
Any other input or best practices around indexing config_files?
