topic Re: Replication Bundle in Splunk Cloud Platform

Replication Bundle

sol69 — Thu, 29 Feb 2024 21:54:22 GMT

How do I fix replication bundle on Splunk Cloud SH?

Re: Replication Bundle

richgalloway — Fri, 01 Mar 2024 01:08:57 GMT

It depends on what's wrong with it. Tell us more or contact Splunk Support.

Re: Replication Bundle

sol69 — Fri, 01 Mar 2024 11:44:01 GMT

The current bundle directory contains a large lookup file that might cause bundle replication fail. The path to the directory is /opt/splunk/var/run/sh-i-***********.splunlcloud.com-17*********.bundle. It's a cloud environment. Checked the HF and found nothing on the path to tar. There's seems nothing on the community for cloud environment. Found some solution for on prem. Thanks for your help

Re: Replication Bundle

richgalloway — Fri, 01 Mar 2024 13:52:43 GMT

You won't find search bundles on your HFs. They're passed from SH to indexers.

Run this search to find out how big your lookup files are. Make sure none are growing unexpectedly. Trim the ones you can. Consider adding the ones that don't need to be on the indexers to your deny list.

index=_audit host=sh* isdir=0 size lookups (action=update OR action=created OR action=modified OR action=add) NOT action=search | stats latest(eval(size/1024/1024)) as size_mb latest(_time) as _time by path | rex field=path "users\/(?<user>.*?)\/" | rex field=path "\/apps\/(?<app>.*?)" | fields _time path size_mb app file | sort 0 - size_mb

Re: Replication Bundle

sol69 — Fri, 01 Mar 2024 15:28:34 GMT

Thanks for the search, is there an spl to trim or archive it?

Re: Replication Bundle

richgalloway — Fri, 01 Mar 2024 15:35:52 GMT

Once you find the big lookup files, use admin commands/UI to delete them. Or use the Lookup File Editor to modify them. You also can upload an app containing a distsearch.conf file to put a file on the deny list.