The Indexers Were Going Down Frequently and the next Message Was Appearing: The index processor has paused the data flow.

Applicability

Description

throttled - The index processor has paused data flow. 
Too many tsidx files in idx=firewall bucket="/data1/splunk/firewall/db/hot_v1_XXX", waiting for the splunk-optimize indexing helper to catch up merging them. 
Ensure reasonable disk space is available, and that I/O write throughput is not compromised.

Investigation

The issue faced in the next Splunk document: Managing Indexers and Clusters of Indexers. And it's related to Indexes optimizing tasks.

You can check the next link as a reference:
Optimize indexes
https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Optimizeindexes

From the document it derives that the necessary considerations to take into account are:

• The suggested command needs to be run on every Indexer.

• The command runs properly on hot buckets. So, you can run it without stopping Splunk on the Indexers.

• However, you can run it as well on warm buckets manually.

Resolution

$splunk-optimize -d|--directory <bucket_directory> --> general structure

$splunk-optimize -d /data1/splunk/firewall/db