Have you gone down this path of checking? path="XXX/rawdata" Please check/repair bucket path='XXX' wih 'fsck' as it could be corrupted. heres what I'd do.  Put the cluster in maintenance mode. stop splunk on the indexer having this issue. see what mount/filesystem splunks on  lsblk -f df -Th mount | grep splunk found where Splunk is installed at see what this reports sudo fsck -n /dev/blockDevicSplunkIsInstalledOn that just checks only. For YOLO sudo fsck /dev/blockDevicSplunkIsInstalledOn regardless, at least take a snapshot of the server or cp -r /opt/splunk and move it off server.  let us know what you find. ... View more