1: 背景:
最近Splunk 监控 健康检查 发现如下报错:
The percentage of small buckets(98) created over the last hour is high and exceeded the red thresholds (30) for index=_internal....
2: 网上看了下原理:
The main cause of this issue is most likely going to be because the timestamps on the data you are feeding in are all over the place. Splunk wants to be mostly chronological, so the buckets contain data from a certain window of time.
For example, if your max buckets was set to say