Red health status due to small bucket creation

Applicability

Splunk Enterprise

Description

After upgrading from 8.0.5 to 8.2.1, the below health warnings are appearing

"The percentage of small of buckets created (100) over the last hour is very high"

Logs ingested for that index contain multiple timestamps inside and the size of logs is in GBs and is very difficult to find.
 

Investigation

In indexes.conf found 'minHotIdleSecsBeforeForceRoll' was set to 600 (beginning value).
A small bucket is defined as less than 10 % of the ‘maxDataSize’ setting in indexes.conf.In health.conf found the below threshold values for Red/yellow under

$SPLUNK_HOME/etc/system/default/health.conf

[feature:buckets]
display_name = Buckets
..
indicator:buckets_created_last_60m:yellow = 30
indicator:percent_small_buckets_created_last_24h:red = 40

Note: Since there were 50+ indexes and logs ingested to each index in GBs.
  

Resolution

In indexes.conf 'minHotIdleSecsBeforeForceRoll'  has not been changed to 0 and restarted Indexers It was looking good for a few hours but it started happening again.

In health.conf  increase the Red/yellow threshold value.

$SPLUNK_HOME/etc/system/default/health.conf

[feature:buckets]
display_name = Buckets
..
indicator:buckets_created_last_60m:yellow = 40
indicator:percent_small_buckets_created_last_24h:red = 50

Making these changes in Indexes.conf and health.conf fixed the issue.
Note: If the log ingestion volume is normal, suggesting 'minHotIdleSecsBeforeForceRoll'=0 in Indexes.conf must have fixed the issue.

 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release