How to fix "Percentage of small buckets is high"?

[uagraw01]

I am getting below error from Splunkd. How to fix this root cause error. Please suggest some workaround.

[isoutamo]

Hi

This said that small bucket count in _internal is 4, which is not so high. 

Have you any reason why this has happened e.g. some reboot service/server or other reason why those buckets has roll over from hot to warm?

Anyhow you must know why those buckets has rolled before you could fix the issue? Some possible reasons could be:

• reboot splunk
• manually rolled those
• bad data (e.g. time stamp issues)
• you reinvesting old and new log files / data at same time

r. Ismo

[uagraw01]

@isoutamo For now simple restart of splunkd fixed my issue.