https://community.splunk.com/t5/Splunk-Dev/DistributedBundleReplicationManager-bundle-replication-to-1-peer/m-p/56814#M745 <P>I am receiving the following error message in my splunkd log. DistributedBundleReplicationManager - bundle replication to 1 peer(s) took too long. Do you know what is causing it and how I can fix it?</P> Sun, 10 Mar 2013 22:15:41 GMT drussell88 2013-03-10T22:15:41Z https://community.splunk.com/t5/Splunk-Dev/DistributedBundleReplicationManager-bundle-replication-to-1-peer/m-p/56814#M745 <P>I am receiving the following error message in my splunkd log. DistributedBundleReplicationManager - bundle replication to 1 peer(s) took too long. Do you know what is causing it and how I can fix it?</P> Sun, 10 Mar 2013 22:15:41 GMT https://community.splunk.com/t5/Splunk-Dev/DistributedBundleReplicationManager-bundle-replication-to-1-peer/m-p/56814#M745 drussell88 2013-03-10T22:15:41Z https://community.splunk.com/t5/Splunk-Dev/DistributedBundleReplicationManager-bundle-replication-to-1-peer/m-p/56815#M746 <P>I also need to mention that I only have one search head, one indexer and 39 universal forwarders. I am not sure why this is warnining for distributed bundle replication.</P> Mon, 11 Mar 2013 15:02:31 GMT https://community.splunk.com/t5/Splunk-Dev/DistributedBundleReplicationManager-bundle-replication-to-1-peer/m-p/56815#M746 drussell88 2013-03-11T15:02:31Z https://community.splunk.com/t5/Splunk-Dev/DistributedBundleReplicationManager-bundle-replication-to-1-peer/m-p/56816#M747 <P>This is caused by stuff being replicated from the SH to the indexer. AFAIK, this is most often just a warning that it took long time, not TOO long time. So normally your bundle got replicated, but it took more than X seconds.</P> <P>Quite likely you have some large piece of data in one of your apps (MAXMIND is one I've come across that contains a lot of data).</P> <P><A href="http://splunk-base.splunk.com/answers/31724/bundle-replication-taking-too-long">http://splunk-base.splunk.com/answers/31724/bundle-replication-taking-too-long</A><BR /> <A href="http://splunk-base.splunk.com/answers/68488/what-does-this-event-mean-warn-distributedbundlereplicationmanager-bundle-replication-to-24-peers-took-too-long">http://splunk-base.splunk.com/answers/68488/what-does-this-event-mean-warn-distributedbundlereplicationmanager-bundle-replication-to-24-peers-took-too-long</A></P> <P>BR,</P> <P>Kristian </P> Mon, 11 Mar 2013 15:20:42 GMT https://community.splunk.com/t5/Splunk-Dev/DistributedBundleReplicationManager-bundle-replication-to-1-peer/m-p/56816#M747 kristian_kolb 2013-03-11T15:20:42Z https://community.splunk.com/t5/Splunk-Dev/DistributedBundleReplicationManager-bundle-replication-to-1-peer/m-p/56817#M748 <P>Thank you for your reply. Could this cause lag time in my saved searches? What is the best way to find these large pieces of data in my apps?</P> Mon, 11 Mar 2013 17:20:03 GMT https://community.splunk.com/t5/Splunk-Dev/DistributedBundleReplicationManager-bundle-replication-to-1-peer/m-p/56817#M748 drussell88 2013-03-11T17:20:03Z