Got an update from Splunk Support so figured I'd share here: inflight buckets are actually searchable buckets. There are 2 possible ways to deal with them.   Deleting them is an option because they consume space and won't be rolled out. If you consider they are not needed, go ahead and remove them.   I wouldn't suggest deleting them because they might still hold relevant data. In that case, there can be repaired so they roll out to cold on their own, and eventually age out normally.  I'll include instructions on how to fix them:   How to repair buckets:   1- Identify the inflight bucket. e.g inflight-db_1281863647_1281646469_455. 2- If you are in a cluster environment, put the CM in maintenance mode and issue ./splunk offline on the IDX where the inflight bucket is located. You need to find the primary inflight bucket(inflight-db). 3- Rename the inflight bucket to a normal bucket. e.g from inflight-db_1281863647_1281646469_455 to db_1281863647_1281646469_455, then turn back up the IDX and remove the maintenance mode on the CM. 4- After this, Splunk will replicate the bucket and move it to the coldPath. ... View more