|
What are the id_XX buckets that show up under "index activity", They also show up in the bucket directories. What do these represent? |
|
Just to update this answer, looks like rebuilding the meta data and bucket manifest removed any record of the buckets under "index activity" The actual buckets dont exist under the db directories anymore. So performing these steps should clear them up
|
|
It means we couldn't figure out whether the bucket in question was a hot/warm or cold bucket. I'd be interested to see the output of when you repro this: % grep DatabaseInspectCommand $SPLUNK_HOME/var/log/splunk/splunkd.log | grep ERROR |
|
looks like a lot of log activity with increasing bucket ID's Here's a sample One other entry too |
|
Interesting, this means the buckets were moved from underneath splunk, or splunk lost track of them somehow At the time you see those id_xyz buckets in via |dbinspect, check to see if the bucket/s with id 'xyz' actually even exist within splunk? |