I am running 2 search:
| rest splunk_server=* /services/data/indexes-extended | search title = _internal| stats max(bucket_dirs.home.warm_bucket_count) by title| dbinspect index=_internal | search state = warm | stats countBoth are run for all time, why am i getting different count of warm data.Also, my max warm bucket count is restriceted to 450, while rest api call is giving me a no below this, dbinspect is giving me 2550. How is this possible.
total number of buckets are depending on how many indexers you have and replication factor.
for example if you have 4 indexers, max total number of buckets would be 450*4.
I have run searches you have shared in my standard alone box. its giving exact same results.