超级会员免费看
当Splunk监控到小桶（small buckets）创建比例超过阈值时，可能存在时间戳不连续的问题。这通常由于数据时间戳混乱导致。解决方法包括调整indexes.conf中_maxHotBuckets_参数、校正数据源时间戳或配置props.conf的DATETIME_CONFIG。通过增加maxHotBuckets值至5并重启索引服务器，问题得到解决。
1: 背景：
最近Splunk 监控 健康检查 发现如下报错：
The percentage of small buckets(98) created over the last hour is high and exceeded the red thresholds (30) for index=_internal....
2: 网上看了下原理：
The main cause of this issue is most likely going to be because the timestamps on the data you are feeding in are all over the place. Splunk wants to be mostly chronological, so the buckets contain data from a certain window of time.
For example, if your max buckets was set to say
订阅专栏 解锁全文
574
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
