Splunk例項運行狀況顯示桶元件的RED
適用性
Splunk企業版說明
在過去一小時內，建立的小儲存段(100)的百分比非常高，並且超過此索引器上index=<index name>的紅色閾值(50)，並且可能超過更多索引。運行狀況檢查頁籤中的錯誤消息：
Buckets Root Cause(s): The percentage of small of buckets created (100) over the last hour is very high and exceeded the red thresholds (50) for index=mbam, and possibly more indexes, on this indexer最近50條相關消息：
07-02-2019 02:16:05.989 -0700 INFO HotBucketRoller - finished moving hot to warm bid=_internal~4984~99D2CFA5-1005-45DA-8C68-0E8A5FB0C95C idx=_internal from=hot_v1_4984 to=db_1562087584_1562043339_4984 size=1048645632 caller=size_exceeded _maxHotBucketSize=1048576000 (1000MB), bucketSize=1048641536 (1000MB) 07-02-2019 00:22:57.931 -0700 INFO HotBucketRoller - finished moving hot to warm bid=_introspection~2046~99D2CFA5-1005-45DA-8C68-0E8A5FB0C95C idx=_introspection from=hot_v1_2046 to=db_1562027109_1562015374_2046 size=569110528 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 07-02-2019 00:00:22.067 -0700 INFO HotBucketRoller - finished moving hot to warm bid=cloudflare~324~99D2CFA5-1005-45DA-8C68-0E8A5FB0C95C idx=cloudflare from=hot_v1_324 to=db_1561885206_1561791602_324 size=394207232 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 07-01-2019 23:03:37.981 -0700 INFO HotBucketRoller - finished moving hot to warm bid=_internal~4983~99D2CFA5-1005-45DA-8C68-0E8A5FB0C95C idx=_internal from=hot_v1_4983 to=db_1562076172_1562032683_4983 size=1054523392 caller=size_exceeded _maxHotBucketSize=1048576000 (1000MB), bucketSize=1054404608 (1005MB) 07-01-2019 22:43:06.030 -0700 INFO HotBucketRoller - finished moving hot to warm bid=clearpass~362~99D2CFA5-1005-45DA-8C68-0E8A5FB0C95C idx=clearpass from=hot_v1_362 to=db_1561787045_1561538116_362 size=393191424 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots
調查
上面的消息說，為過去24小時建立的儲存桶的100%小於maxDataSize的10%。這不會導致任何效能問題。要解決此警告，您可以將閾值從50增加到150，如下所示。預設配置位於$SPLUNK_HOME/etc/system/default/health.conf位置
[feature:buckets] display_name = Buckets indicator:percent_small_buckets_created_last_24h:description = "This indicator tracks the percentage of small buckets created over the last 24 hours. small bucket is defined as less than 10 % of the ‘maxDataSize’ setting in indexes.conf." indicator:percent_small_buckets_created_last_24h:red = 50 indicator:percent_small_buckets_created_last_24h:yellow = 30
此外，當為索引特定小時/天的資料而建立的熱桶數超過或達到system/health.conf中定義的閾值限制時，也會顯示以上相同的運行狀況警告消息。
建立過多熱桶的原因
Splunk使用儲存段作為索引目錄來索引資料。現在，當一個事件進入Splunk進行索引時，將為該事件建立新的熱桶，或者根據事件在索引上的時間戳和約束將該事件索引到現有的一個熱桶。
請參閱indexes.conf的maxHotBuckets、maxHotSpanSecs和quarantinePastSecs引數
因此，如果事件的時間戳比現有儲存桶可接受的時間戳更舊/奇怪，則Splunk將建立一個新的熱儲存桶以索引該事件。因此，所建立的熱儲存桶的數量可能達到或超過閾值。
props.conf的DATETIME_CONFIG引數未顯式設定時，Splunk將嘗試在事件本身中查詢時間戳。
因此，從事件中提取時間戳時，如果Splunk找到與有效時間戳格式匹配的值，它將解析與事件時間相同的值，並將僅使用該時間戳對其進行索引，這可能導致Splunk建立新的熱桶，因為時間戳沒有正確提取。
考慮在props.conf中新增時間戳屬性，以使Splunk正確提取時間戳。配置時間戳識別
此外，我還在splunkd.log中找到了以下有關時間戳的消息，並應用了正確的設定對它們進行了修復，具體取決於日誌格式。
06-02-2019 22:37:36.976 -0700 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (30) characters of event.
Defaulting to timestamp of previous event (Mon Jun 3 02:37:35 2019). Context: source=/data/syslogng/asa/richmond-vpn-inside/20190603.log|host=richmond-vpn-inside
|cisco:asa|48952806-21-2019 09:48:48.467 -0700 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (44) characters of event.
Defaulting to timestamp of previous event (Fri Jun 21 06:48:45 2019). Context: source=/data/syslogng/pan/vcadcl-fw-mgmt/20190621.log|host=vcadcl-fw-mgmt|pan_log|86736606-20-2019 11:29:10.742 -0700 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event.
Defaulting to timestamp of previous event (Thu Jun 20 11:29:10 2019). Context: source=/scratch/data/syslogng/vlsj-securelog/sj-anliu1/20190620.log|host=sj-anliu1
|linux_secure|526909106-14-2019 12:46:38.301 -0700 WARN DateParserVerbose - Accepted time format has changed ((?i)\s([01]\d)([0123]\d\d)\s), possibly indicating a problem
in extracting timestamps. Context: source=C:\Windows\debug\netlogon.log|host=DC2SJGLOBAL|MSAD:NT6:Netlogon|4001606-02-2019 16:17:18.106 -0700 WARN DateParserVerbose - Accepted time format has changed ((?i)(?<!\w|\d[:\.\-])(?i)(?<![\d\w])(jan|\x{3127}\x{6708}|feb|\x{4E8C}\x{6708}
|mar|\x{4E09}\x{6708}|apr|\x{56DB}\x{6708}|may|\x{4E94}\x{6708}|jun|\x{516D}\x{6708}|jul|\x{4E03}\x{6708}|aug|\x{516B}\x{6708}|sep|\x{4E5D}\x{6708}|oct|\x{5341}\x{6708}
|nov|\x{5341}\x{3127}\x{6708}|dec|\x{5341}\x{4E8C}\x{6708})[a-z,\.;]*([/\- ]) {0,2}(?i)(0?[1-9]|[12]\d|3[01])(?!:) {0,2}(?:\d\d:\d\d:\d\d(?:[\.\,]\d+)? {0,2}(?i)((?:(?:
UT|UTC|GMT(?![+-])|CET|CEST|CETDST|MET|MEST|METDST|MEZ|MESZ|EET|EEST|EETDST|WET|WEST|WETDST|MSK|MSD|IST|JST|KST|HKT|AST|ADT|EST|EDT|CST|CDT|MST|MDT|PST|PDT|CAST|CADT|EAST
|EADT|WAST|WADT|Z)|(?:GMT)?[+-]\d\d?:?(?:\d\d)?)(?!\w))?)?((?:\2|,) {0,2}(?i)(20\d\d|19\d\d|[901]\d(?!\d)))?(?!/|\w|\.\d)), possibly indicating a problem
in extracting timestamps. Context: source=C:\Windows\System32\DHCP\DhcpSrvLog-Mon.log|host=srv07-seoul|DhcpSrvLog|286986
解析
1.導航至$SPLUNK_HOME/etc/system/local/health.conf並附上stanza[feature:buckets] indicator:percent_small_buckets_created_last_24h:red = 150
2.重新啟動Splunk以使更改生效。
如果是時間戳或DATETIME_CONFIG問題，請寫下適當的正規表示式，以正確識別事件的日期和時間，並糾正問題。
相關連結
Splunk文檔配置時間戳識別
Splunk答案
運行狀況：已建立的小儲存桶百分比
修訂記錄
| 修訂 | 發佈日期 | 意見 |
|---|---|---|
1.0 |
28-Sep-2026
|
初始版本 |
意見