I regularly have excess buckets and I haven't tested if they would freeze as per normal. I would assume they would as they are still tracked by the cluster manager...they are just extra buckets for the generation the manager has set, they are just considered excess to the current replication and search factor. Otherwise it's just another bucket. I even have https://ideas.splunk.com/ideas/E-I-75 open as I believe they should automatically remove themselves over time.
... View more
