Have never had this error before, but today we had an alert that 100 buckets were created and it appears to be a lot of buckets going from hot to warm status.
We've been using splunk for several years now and are on the latest version 7.2.0. First time seeing a message like this. Our threshold setting for bucket 'red' status is set to 50.
Where is the management setting for when buckets roll from hot to warm and is this an indication of something else wrong or new with 7.2?
