Deployment Architecture

What can I do in a Throttling indexer, too many tsidx files in bucket, situation?

ddrillic
Ultra Champion

I see this message quite often -

throttled: idx=<index name> Throttling indexer, too many tsidx files in bucket='/SplunkIndexData/splunk-indexes/<index name>/db/hot_v1_2094'. Is splunk-optimize working? If not, low disk space may be the cause. 

What should I do?

Tags (2)
0 Karma
1 Solution

pdaigle_splunk
Splunk Employee
Splunk Employee

Depending on your version of Splunk, there is/was a bug that was fixed in version 6.6.7 where clustering was generating too many buckets erroneously:

http://docs.splunk.com/Documentation/Splunk/6.6.8/ReleaseNotes/6.6.7

It was also fixed in version 7.0.3 and 7.1.0:

http://docs.splunk.com/Documentation/Splunk/7.0.3/ReleaseNotes/Fixedissues

http://docs.splunk.com/Documentation/Splunk/7.1.0/ReleaseNotes/Fixedissues

Are your Indexers clustered?

Maybe this is what is going on?

View solution in original post

pdaigle_splunk
Splunk Employee
Splunk Employee

Depending on your version of Splunk, there is/was a bug that was fixed in version 6.6.7 where clustering was generating too many buckets erroneously:

http://docs.splunk.com/Documentation/Splunk/6.6.8/ReleaseNotes/6.6.7

It was also fixed in version 7.0.3 and 7.1.0:

http://docs.splunk.com/Documentation/Splunk/7.0.3/ReleaseNotes/Fixedissues

http://docs.splunk.com/Documentation/Splunk/7.1.0/ReleaseNotes/Fixedissues

Are your Indexers clustered?

Maybe this is what is going on?

ddrillic
Ultra Champion

Interesting - we are with 6.5.2. and right, our indexers are clustered.

A related thread at Indexing throttled due to "too many tsidx files" - Is splunk-optimize working?

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...