https://community.splunk.com/t5/Deployment-Architecture/How-should-I-set-the-con-replication-max-pull-count-value-for/m-p/222809#M8342 <P>replication_factor = 1</P> <P>but that is only for replication of search artifacts</P> <P>The WARN message is referring to configuration changes, like knowledge objects changing by users via the UI.</P> Fri, 26 Feb 2016 18:51:32 GMT ben_leung 2016-02-26T18:51:32Z https://community.splunk.com/t5/Deployment-Architecture/How-should-I-set-the-con-replication-max-pull-count-value-for/m-p/222807#M8340 <PRE><CODE>WARN ConfMetrics - single_action=PULL_FROM took wallclock_ms=4610! Consider a lower value of conf_replication_max_pull_count in server.conf on all members </CODE></PRE> <P>What should I base the value on for conf_replication_max_pull_count? The warning is telling me that the cluster nodes are taking too long to pull configuration changes from the captain. Is my understanding correct?</P> <PRE><CODE>conf_replication_max_pull_count = &lt;int&gt; * Controls the maximum number of configuration changes a member will replicate from the captain at one time. * A value of 0 disables any size limits. * Defaults to 1000. </CODE></PRE> Tue, 29 Sep 2020 08:56:14 GMT https://community.splunk.com/t5/Deployment-Architecture/How-should-I-set-the-con-replication-max-pull-count-value-for/m-p/222807#M8340 ben_leung 2020-09-29T08:56:14Z https://community.splunk.com/t5/Deployment-Architecture/How-should-I-set-the-con-replication-max-pull-count-value-for/m-p/222808#M8341 <P>What is your cluster's ref factor?</P> Fri, 26 Feb 2016 18:39:42 GMT https://community.splunk.com/t5/Deployment-Architecture/How-should-I-set-the-con-replication-max-pull-count-value-for/m-p/222808#M8341 splunkIT 2016-02-26T18:39:42Z https://community.splunk.com/t5/Deployment-Architecture/How-should-I-set-the-con-replication-max-pull-count-value-for/m-p/222809#M8342 <P>replication_factor = 1</P> <P>but that is only for replication of search artifacts</P> <P>The WARN message is referring to configuration changes, like knowledge objects changing by users via the UI.</P> Fri, 26 Feb 2016 18:51:32 GMT https://community.splunk.com/t5/Deployment-Architecture/How-should-I-set-the-con-replication-max-pull-count-value-for/m-p/222809#M8342 ben_leung 2016-02-26T18:51:32Z https://community.splunk.com/t5/Deployment-Architecture/How-should-I-set-the-con-replication-max-pull-count-value-for/m-p/222810#M8343 <P>Unless advised by Support, it's probably not a good idea to modify the conf_replication_max_pull_count setting.</P> <P>The WARN itself is not necessarily a problem, unless it corresponds to slow UI response times and/or general system problems. </P> <P>In general, note that this message is based on wallclock time. That means any performance problem on the system – e.g. memory pressure or contention for CPU – can cause this WARN. It isn't always a problem with the configuration replication workload itself. </P> <P>If the WARN message corresponds to slow UI response times and/or general system problems, then please contact Support and provide the following artifacts for further analysis: </P> <P>1.) Collect new diags from captain and from at least one of the member nodes <BR /> 2.) On each of the search heads, please take of backup of the latest bundle file under var/run/splunk/snapshot to a temporary directory, and provide them as well</P> Tue, 29 Sep 2020 09:10:26 GMT https://community.splunk.com/t5/Deployment-Architecture/How-should-I-set-the-con-replication-max-pull-count-value-for/m-p/222810#M8343 splunkIT 2020-09-29T09:10:26Z