Distributed Search Knowledge Bundle Regex

Splunker — Mon, 19 Dec 2011 11:51:58 GMT

Folks,

I have a Splunk 4.2.4 search-head and indexer on another machine in a distributed setup.

I'm getting an error in my splunkd.log about my knowledge bundle timing out replicating from search-head to indexer.

I've tried the following in my distsearch.conf:

[replicationWhitelist] allConf = *.conf allSpec = *.spec

Based on the Splunk docs. Looking in $SPLUNK_HOME/var/run/searchpeers/(latest).bundle on the indexer i see all sorts of files in the tarball not just the ones i've allowed via my whitelist.

I've restarted both search-head & indexer and am not sure what to try next? Do i also need a global blacklist?

Thanks.

Re: Distributed Search Knowledge Bundle Regex

Splunker — Mon, 26 Dec 2011 09:59:03 GMT

I managed to fix the above problem after realising the regex's need the full path to the offending large files.

*.conf seems to only match in the root-level directories ($SPLUNK_HOME/etc /users /etc/apps, etc..)

Something like (i had a large lookup list in my Google Maps and MAXMIND app (the geoip DB)):

[replicationBlacklist] AppMapsCSV = maps/local/*.csv AppMaxMindCSV = MAXMIND/local/*.csv

Did the trick, which significantly dropped my knowledge bundle size to something more manageable.

Hope it helps someone 🙂

topic Re: Distributed Search Knowledge Bundle Regex in Deployment Architecture

Distributed Search Knowledge Bundle Regex

Re: Distributed Search Knowledge Bundle Regex