This can happen when metadata gets corrupted in Splunk. It's related to an issue when using the Delete command. (i've seen this in 4.2). Engineering is aware of the problem and working on a fix.
You can verify this by looking in your indexers splunkd.log for 'safeService' warnings. If you see these, stop splunk and issue:
$SPLUNK_HOME/bin/splunk cmd splunkd fsck --all --mode metadata --repair
This will rebuild your metadata files for each of your indexes. It's similar to the 'recovery' process you see during unclean shutdowns.
... View more