Just to update this answer, looks like rebuilding the meta data and bucket manifest removed any record of the buckets under "index activity" The actual buckets dont exist under the db directories anymore.
So performing these steps should clear them up
Just to update this answer, looks like rebuilding the meta data and bucket manifest removed any record of the buckets under "index activity" The actual buckets dont exist under the db directories anymore.
So performing these steps should clear them up
Interesting, this means the buckets were moved from underneath splunk, or splunk lost track of them somehow
At the time you see those id_xyz buckets in via |dbinspect, check to see if the bucket/s with id 'xyz' actually even exist within splunk?
looks like a lot of log activity with increasing bucket ID's
Here's a sample
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5538
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5539
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5540
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5541
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5542
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5543
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5544
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5545
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5546
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5547
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5548
One other entry too
- Unable to run timechart with span = 1y because Error in 'makecontinuous' command: Invalid value for option span: '1y'
It means we couldn't figure out whether the bucket in question was a hot/warm or cold bucket. I'd be interested to see the output of when you repro this:
% grep DatabaseInspectCommand $SPLUNK_HOME/var/log/splunk/splunkd.log | grep ERROR