https://community.splunk.com/t5/Deployment-Architecture/How-do-bundles-work-with-the-forwarders/m-p/452225#M15885 <P>All along we spoke about bundles on the indexers and SHs, but yesterday my colleague mentioned to me that they are used also with the forwarders. I believe the bundles reside at <CODE>C:\opt\splunk\splunkforwarder\var\run</CODE> on our windows forwarders.</P> <P>Any information about it?</P> Fri, 28 Jun 2019 17:04:51 GMT ddrillic 2019-06-28T17:04:51Z https://community.splunk.com/t5/Deployment-Architecture/How-do-bundles-work-with-the-forwarders/m-p/452225#M15885 <P>All along we spoke about bundles on the indexers and SHs, but yesterday my colleague mentioned to me that they are used also with the forwarders. I believe the bundles reside at <CODE>C:\opt\splunk\splunkforwarder\var\run</CODE> on our windows forwarders.</P> <P>Any information about it?</P> Fri, 28 Jun 2019 17:04:51 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-bundles-work-with-the-forwarders/m-p/452225#M15885 ddrillic 2019-06-28T17:04:51Z https://community.splunk.com/t5/Deployment-Architecture/How-do-bundles-work-with-the-forwarders/m-p/452226#M15886 <P>The bundles sent from search head to indexer are not sent anywhere else.<BR /> Search heads do not communicate with forwarders.<BR /> Forwarders send data to indexers, but that is not a "bundle".<BR /> Deployment Servers (which can be part of an SH instance) communicate with forwarders to tell them which apps to download. These are not "bundles", either.</P> Thu, 04 Jul 2019 14:29:40 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-bundles-work-with-the-forwarders/m-p/452226#M15886 richgalloway 2019-07-04T14:29:40Z https://community.splunk.com/t5/Deployment-Architecture/How-do-bundles-work-with-the-forwarders/m-p/452227#M15887 <P>Not sure about the terminology but I see the following -</P> <PRE><CODE>/monitor/splunkforwarder-linux/var/run/&lt;app&gt; $ \ls -tlr total 1252 -rw-------. 1 splunknu dce 1239040 May 16 11:15 Splunk_TA_nix-1558023151.bundle -rw-------. 1 splunknu dce 40960 Jun 14 09:38 &lt;app&gt;-1560523046.bundle </CODE></PRE> <P>And by removing this <CODE>*.bundle</CODE> file, the deployment server sends a new one.</P> Mon, 08 Jul 2019 21:07:10 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-bundles-work-with-the-forwarders/m-p/452227#M15887 ddrillic 2019-07-08T21:07:10Z https://community.splunk.com/t5/Deployment-Architecture/How-do-bundles-work-with-the-forwarders/m-p/452228#M15888 <P>Those are the apps downloaded by the forwarder from the DS. They're not usually referred to as bundles, but I see that is what the forwarder calls them. Thanks for the education!</P> Tue, 09 Jul 2019 12:10:34 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-bundles-work-with-the-forwarders/m-p/452228#M15888 richgalloway 2019-07-09T12:10:34Z https://community.splunk.com/t5/Deployment-Architecture/How-do-bundles-work-with-the-forwarders/m-p/452229#M15889 <P>Thank you @richgalloway for all your help - it was interesting to see these <CODE>*.bundle</CODE> files on the forwarder ; -) </P> Tue, 09 Jul 2019 14:11:49 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-bundles-work-with-the-forwarders/m-p/452229#M15889 ddrillic 2019-07-09T14:11:49Z https://community.splunk.com/t5/Deployment-Architecture/How-do-bundles-work-with-the-forwarders/m-p/452230#M15890 <P>The following mentions the <CODE>*.bundle</CODE> files but not their <CODE>var/run/&lt;app&gt;</CODE> location - <A href="https://docs.splunk.com/Documentation/Splunk/7.3.0/Updating/Extendedexampledeployseveralstandardforwarders">Extended example: Deploy configurations to several forwarders</A></P> <P>In the page, we can search for <CODE>fwd_to_splunk1-timestamp.bundle</CODE>.</P> Wed, 17 Jul 2019 19:52:05 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-bundles-work-with-the-forwarders/m-p/452230#M15890 ddrillic 2019-07-17T19:52:05Z