Splunk Enterprise

Percentage of small buckets created exceed the threshold over the last hour

vigneshwar_c
New Member

Hello all,

I am getting below error in splunk deployment, On checking the splunk internal logs index="_internal" component=HotBucketRoller caller=clusterslavecontrol_rollhotbucket idx=_internal

The hotbucket is rolled out to warm by the component HotBucketRoller by clusterslavecontrol_rollhotbucket

 

07-23-2023 12:39:23.522 -0400 INFO HotBucketRoller [35263 indexerPipe] - finished moving hot to warm bid=_internal~18979~0754D341-849D-4A16-9B2B-322415DA7E29 idx=_internal from=hot_v1_18979 to=db_1690130735_1690130086_18979_0754D341-849D-4A16-9B2B-322415DA7E29 size=3182592 caller=clusterslavecontrol_rollhotbucket isinit=false selective=false

the bucket rolled out by this method are too smal size.

Capture_a1.PNG

Labels (1)
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...