Many small buckets are getting created over a period of one hour on many indexers.

Applicability

Splunk Enterprise

Description

The errors shown on multiple indexers is presented below :

Issue: Buckets Root Cause(s): The Percentage of small buckets (75%) created over the last hour is high and exceeded the red thresholds (50%) 
for index =_internet, and possibly more indexes on this indexer. At the time this alert fired, total buckets created =4,small buckets=3.
 

Investigation

 Validated that this issue started after upgrading the Splunk version from 8.1.7 to 8.2.3.

Implemented the first probable Workaround :

• Created a "indexes.conf" in $SPLUNK_HOME/etc/system/local/
•  Added the following stanza 

[default]
minHotIdleSecsBeforeForceRoll = 0 

• Pushed it through /etc/master-apps/app/local/indexes.conf.
• Restarted the indexer.

This did not work as every search got skipped, so the change was reverted back.
It was because the option implemented could not control the data flow properly.

Tried a second probable Workaround :-

• Created a "indexes.conf" in $SPLUNK_HOME/etc/system/local/indexes.conf
• Added the stanza

[_internal]
maxHotBuckets = 6

 The maxHotBuckets could be increased up to a value of 10.

• Pushed it through /etc/master-apps/app/local/indexes.conf.
• Restarted the indexer.

Still the changes. were not working.

• Observed another issue, that the data on the internal index is coming from a different timezone and it was due to the data being on the wrong timezone.
• Each server should be in sync and should be set to the same timezone. 

Resolution

Going back to the error message, it basically signifies that 100% of the buckets created for the last 24 hours are less than 10% of maxDataSize. 
There is no performance issue related to this.

Workaround:-

**Increase the MAX_DAYS_HENCE in props.conf :-

1. Navigated to $SPLUNK_HOME$/etc/system/local/props.conf and appended the below stanza :

[default]
MAX_DAYS_HENCE = 3 

2. Pushed it through /etc/master-apps/app/local/indexes.conf.

3. Restarted Splunk for changes to take effect.

4.  Navigated to $SPLUNK_HOME$/etc/system/local/health.conf and appended the below stanza :

[feature:buckets]
indicator:percent_small_buckets_created_last_24h:red = 150 

5. Pushed it through /etc/master-apps/app/local/health.conf

6.  Restarted Splunk.

7. In the props. conf, adjusted the TZ= setting for the respective sourcetype, and perform it on the heavy forwarder.

[sourcetype_goes_here]
TZ = [Name of the timezone]

 

Related Links

https://community.splunk.com/t5/Getting-Data-In/Health-Status-The-percentage-of-small-of-buckets-created-75-over/td-p/400302
https://community.splunk.com/t5/Deployment-Architecture/Health-warning-The-percentage-of-small-of-buckets-created-40/m-p/394221
https://community.splunk.com/t5/Splunk-Search/How-to-adjust-the-time-zone-for-an-logs-coming-into-splunk/m-p/306839
https:/docs.splunk.com/Documentation/Splunk/8.2.6/Data/Applytimezoneoffsetstotimestamps

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release