<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: slow distributed search (DistributedBundleReplicationManager ?) in Deployment Architecture</title>
    <link>https://community.splunk.com/t5/Deployment-Architecture/slow-distributed-search-DistributedBundleReplicationManager/m-p/97919#M3607</link>
    <description>&lt;P&gt;Do you have a very large lookup file or something inside one of the apps on your slow search head?&lt;/P&gt;</description>
    <pubDate>Thu, 02 Dec 2010 10:22:59 GMT</pubDate>
    <dc:creator>gkanapathy</dc:creator>
    <dc:date>2010-12-02T10:22:59Z</dc:date>
    <item>
      <title>slow distributed search (DistributedBundleReplicationManager ?)</title>
      <link>https://community.splunk.com/t5/Deployment-Architecture/slow-distributed-search-DistributedBundleReplicationManager/m-p/97918#M3606</link>
      <description>&lt;P&gt;We have 2 search heads, one is a lab box, so lower performance 4 way 8gig ram, but very few people use it. The other is a 16 way box. Our primary search head does no indexing locally at all, the lab box does some, (10,000 events/day). For some reason, the lab box seems REAL slow when doing searches, system load/memory is all good.&lt;/P&gt;

&lt;P&gt;The only thing I have found in the logs is the following:
From Lab box
12-01-2010 23:48:57.669 WARN  DistributedBundleReplicationManager - bundle replication to 8 peer(s) took too long (227349ms), bundle file size=143900KB&lt;/P&gt;

&lt;P&gt;From production:
12-01-2010 19:29:16.536 WARN  DistributedBundleReplicationManager - bundle replication to 10 peer(s) took too long (10474ms), bundle file size=4130KB&lt;/P&gt;

&lt;P&gt;I can't find any real reference to DistributedBundleReplicationManager in any documentation. The 'bundle replication" is taking a lot longer, and I am wondering if the "bundle file size" is making the one system slower than the other. &lt;/P&gt;

&lt;P&gt;Any thoughts?&lt;/P&gt;</description>
      <pubDate>Thu, 02 Dec 2010 07:59:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Deployment-Architecture/slow-distributed-search-DistributedBundleReplicationManager/m-p/97918#M3606</guid>
      <dc:creator>tawollen</dc:creator>
      <dc:date>2010-12-02T07:59:56Z</dc:date>
    </item>
    <item>
      <title>Re: slow distributed search (DistributedBundleReplicationManager ?)</title>
      <link>https://community.splunk.com/t5/Deployment-Architecture/slow-distributed-search-DistributedBundleReplicationManager/m-p/97919#M3607</link>
      <description>&lt;P&gt;Do you have a very large lookup file or something inside one of the apps on your slow search head?&lt;/P&gt;</description>
      <pubDate>Thu, 02 Dec 2010 10:22:59 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Deployment-Architecture/slow-distributed-search-DistributedBundleReplicationManager/m-p/97919#M3607</guid>
      <dc:creator>gkanapathy</dc:creator>
      <dc:date>2010-12-02T10:22:59Z</dc:date>
    </item>
    <item>
      <title>Re: slow distributed search (DistributedBundleReplicationManager ?)</title>
      <link>https://community.splunk.com/t5/Deployment-Architecture/slow-distributed-search-DistributedBundleReplicationManager/m-p/97920#M3608</link>
      <description>&lt;P&gt;We have some lookups, nothing that big, at least not in the app I am using, there might be something in one of the other apps.&lt;/P&gt;</description>
      <pubDate>Fri, 31 Dec 2010 23:30:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Deployment-Architecture/slow-distributed-search-DistributedBundleReplicationManager/m-p/97920#M3608</guid>
      <dc:creator>tawollen</dc:creator>
      <dc:date>2010-12-31T23:30:31Z</dc:date>
    </item>
    <item>
      <title>Re: slow distributed search (DistributedBundleReplicationManager ?)</title>
      <link>https://community.splunk.com/t5/Deployment-Architecture/slow-distributed-search-DistributedBundleReplicationManager/m-p/97921#M3609</link>
      <description>&lt;P&gt;Does some content in your apps change a lot?  Seems like a slow connection if it takes &amp;gt;10s to transfer &amp;lt;4 MB.&lt;/P&gt;</description>
      <pubDate>Fri, 14 Jan 2011 08:48:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Deployment-Architecture/slow-distributed-search-DistributedBundleReplicationManager/m-p/97921#M3609</guid>
      <dc:creator>araitz</dc:creator>
      <dc:date>2011-01-14T08:48:00Z</dc:date>
    </item>
  </channel>
</rss>

