Depending on your version of Splunk, there is/was a bug that was fixed in version 6.6.7 where clustering was generating too many buckets erroneously:
http://docs.splunk.com/Documentation/Splunk/6.6.8/ReleaseNotes/6.6.7
It was also fixed in version 7.0.3 and 7.1.0:
http://docs.splunk.com/Documentation/Splunk/7.0.3/ReleaseNotes/Fixedissues
http://docs.splunk.com/Documentation/Splunk/7.1.0/ReleaseNotes/Fixedissues
Are your Indexers clustered?
Maybe this is what is going on?
Depending on your version of Splunk, there is/was a bug that was fixed in version 6.6.7 where clustering was generating too many buckets erroneously:
http://docs.splunk.com/Documentation/Splunk/6.6.8/ReleaseNotes/6.6.7
It was also fixed in version 7.0.3 and 7.1.0:
http://docs.splunk.com/Documentation/Splunk/7.0.3/ReleaseNotes/Fixedissues
http://docs.splunk.com/Documentation/Splunk/7.1.0/ReleaseNotes/Fixedissues
Are your Indexers clustered?
Maybe this is what is going on?
Interesting - we are with 6.5.2. and right, our indexers are clustered.
A related thread at Indexing throttled due to "too many tsidx files" - Is splunk-optimize working?