What are the id_XX buckets that show up under "index activity"

[Chris_R_]

What are the id_XX buckets that show up under "index activity", They also show up in the bucket directories. What do these represent?

[Chris_R_ · Accepted solution]

Just to update this answer, looks like rebuilding the meta data and bucket manifest removed any record of the buckets under "index activity" The actual buckets dont exist under the db directories anymore.

So performing these steps should clear them up

1. In the /db directory, delete the file .bucketmanifest
2. In the /db directory, create the file (0 bytes works) meta.dirty

[Vishal_Patel]

Interesting, this means the buckets were moved from underneath splunk, or splunk lost track of them somehow

At the time you see those id_xyz buckets in via |dbinspect, check to see if the bucket/s with id 'xyz' actually even exist within splunk?

[Chris_R_]

looks like a lot of log activity with increasing bucket ID's

Here's a sample
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5538
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5539
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5540
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5541
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5542
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5543
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5544
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5545 splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5546
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5547
splunkd.log.2:04-27-2010 08:48:27.761 ERROR DatabaseInspectCommand - Unable to find a directory for bucket id 5548

One other entry too
- Unable to run timechart with span = 1y because Error in 'makecontinuous' command: Invalid value for option span: '1y'

[Vishal_Patel]

It means we couldn't figure out whether the bucket in question was a hot/warm or cold bucket. I'd be interested to see the output of when you repro this:

% grep DatabaseInspectCommand $SPLUNK_HOME/var/log/splunk/splunkd.log | grep ERROR