I do have same issue , any solution would be appreciated. ... View more

Thanks @scelikok  aring the documents .I've followed those steps from very beginning however  peers are failing to connect  new Cluster master (manager node).  ... View more

I could not see any jobs from GUI ,related to excess buckets .  However below  steps on cluster master has fix the issue  1) splunk enable maintenance-mode 2) splunk restart 3) splunk disable maintenance-mode   ... View more

Thanks for your inputs @swong_splunk  . I was trying somethings as below with outlier however it is not working as it should . index="_internal" source="/opt/splunk/var/log/splunk/metrics.log" group=per_index_thruput series=** splunk_server=* earliest=-61m@m latest=-1m@m |rename series as index| eval GB=kb/(1024*1024) | bin _time span=1m | stats sum(GB) as size by _time index | streamstats avg("size") as avg stdev("size") as stdev by "index" | eval lowerBound=(avg-stdev*exact(3)), upperBound=(avg+stdev*exact(3)) | eval isOutlier=if('size' < lowerBound OR 'size' > upperBound, 1, 0) |eval time=strftime(_time, "%m/%d/%y %I:%M:%S:%p")| fields index time size ... View more