I'm guessing there was an unexpected spike? Maybe newly onboarded hosts?
Or what happened on my lab instance where Tomcat got DDoS'd, and kicked 700 gigs of data (off a single instance) into Splunk in about 6 hours … a Splunk instance with only 300G storage (and bucket aging couldn't happen fast enough)
September 09, 2020 at 11:30AM
via reddit https://www.reddit.com/r/Splunk/comments/ipddgm/our_splunk_admin_is_oot_help_with_index_processor/g4jz1eh?utm_source=ifttt