Monitoring Splunk

How to fix "Percentage of small buckets is high"?

uagraw01
Motivator

I am getting below error from Splunkd. How to fix this root cause error. Please suggest some workaround.

 

uagraw01_0-1700669009004.png

 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

This said that small bucket count in _internal is 4, which is not so high. 

Have you any reason why this has happened e.g. some reboot service/server or other reason why those buckets has roll over from hot to warm?

Anyhow you must know why those buckets has rolled before you could fix the issue? Some possible reasons could be:

  • reboot splunk
  • manually rolled those
  • bad data (e.g. time stamp issues)
  • you reinvesting old and new log files / data at same time

r. Ismo

uagraw01
Motivator

@isoutamo For now simple restart of splunkd fixed my issue.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...