Help - why it deletes buckets?

[sylim_splunk]

I'm getting a lot of messages like below, Splunk is deleting buckets from time to time.

04-25-2019 11:51:02.387 +0200 WARN CMMaster - event=removePeerBuckets peer=FA5BC9C-988E08E40-84BB-12345B2345BA peer_name=splunk-indexer-1 bid=_internal~123~CA5BC8Z-A88E08E40-84BB-A2345B2345FF msg="Bucket is not on any other peer! Removing it."

[sylim_splunk · Accepted solution]

Don't panic! Splunk is not actually deleting buckets but it is quite misleading. The bucket information in the CM will be removed while the buckets are there physically on the indexers file system. This is typically happening when the indexers get rolling restarted.