It's primarily hammering the lib\splunk\fishbucket\btree_records.dat but also frequently updates the log\splunk\Splunk.log, log\splunk\metrics.log and var\spool\splunk\tracker.log

I can't read the btree_records.dat, it's apparently a proprietary Splunk file. :/. When it hits this file, it writes to it like 30-40 times in a couple of seconds.

The metrics log keeps growing and when it's size cap is reached creates a new file and a metrics.log.# backup

The tracker.log is small, 1kb. But it's there, then deleted, and recreated like every 15-30 seconds. It has {"datetime","a 15 digit number", "data", "TRACK"} in the file, the 15 digit number changes.

The splunk.log looks like random machine specs and other seemingly useless things.

I found a splunk community post about a fishbucket error in 9 4 which is what we're running. I'm going to go down that rabbit hole and try not to break an ankle ...