I have seen a few of these issues recently. The fix required an increase the default number of allowed max warm buckets. This is not always the magic fix, but if the customer has made changes to configuration files which result in a high number of warm buckets created, this will might be the fix. Often such a state indicates incorrect index configuration, as by default Splunk organizes and optimizes the number of buckets and sizing, and we do not recommend tuning these parameters. Support recommends using the parameter maxVolumeDataSizeMB to control total volume sizing instead. http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/indexesconf maxWarmDBCount = • The maximum number of warm buckets. • Warm buckets are located in the for the index. • If set to zero, it will not retain any warm buckets (will roll them to cold as soon as it can) • Defaults to 300. • Highest legal value is 4294967295 Customers have reported success with increasing it to 3000, but as stated, take a closer took at the parameters set in indexes.conf. I would recommend against trying to explicitly control number of buckets or sizing of buckets as this would be likely to negatively impact performance. ... View more