Thanks 🙂 ... View more

Hi we see the same issue on Splunk 9.1.2. What was the reason for lowering this to 1 from the default of 6? maxConcurrentOptimizes=1   ... View more

Hi no I haven't yet, but I'll give it a try. I am just wondering if it has anything with how often buckets need to be rolled ... View more

We see the following message on most of the indexers ( varies anywhere from 1-4): throttled: The index processor has paused data flow. Too many tsidx files in idx=myindex bucket="/xxxxxxx/xxxx/xxxxxxxxxx/splunk/db/myindex/db/hot_v1_648" , waiting for the splunk-optimize indexing helper to catch up merging them. Ensure reasonable disk space is available, and that I/O write throughput is not compromised.   It's 24 hot buckets rolled to warm across all indexers. Currently we have 4 indexers and each has 2 parallel pipelines. Two of our indexes see this sort of the rate of roll. Rest of them ingest lot less data. ... View more

Hi we are seeing the same issue at peak times.  Currently the bucket size is set to auto=750MB ( for few of our indexes this means rolling 24 hot buckets to warm every minute) Could increasing this to auto_high_volume  help as the buckets wouldn't need to be rolled as often ? ... View more

Hi, thanks for the answer. I've tried this and it works when I upload test data manually but for some reason it doesn't work when I upload it to the HF. Is there any way these logs could already be broken up before they arrive? I've noticed that the logs have slightly different timestamps in the JSON format ie.  2023-01-05T08:56:20.916403009Z and 2023-01-05T08:56:20.916400199Z. I am not sure if this is because they arrived at different times or some processing time on HF. ... View more