This is a bug. Splunk is tracking this as SPL-38603, and it is scheduled to be fixed in 4.2.2.
For the interim, you can use the information here to troubleshoot voume issues:
http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume
... View more
