topic Re: Bundle Replication Issue in Getting Data In

Bundle Replication Issue

ShaneNewman — Tue, 19 Nov 2013 04:48:14 GMT

I have an indexer that seems to be having an issue keeping up with bundles with Splunk 5.0.5. I have been though S.O.S. looking for a cause, the only thing I see in the logs are timeouts waiting for the indexer to receive the bundle. There are 4 servers that maintain bundles with this indexer. This indexer is connected via fiber (10G).

Anyone have any ideas what is going on or where I could look to get more insight into this problem?

Re: Bundle Replication Issue

adityapavan18 — Tue, 19 Nov 2013 11:08:15 GMT

Shane, how big are the bundle files?

You can refer this

http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Configuredistributedsearch#Limit_the_knowledge_bundle_size

And see if the smaller bundles are being pushed without a timeout

Re: Bundle Replication Issue

ShaneNewman — Wed, 20 Nov 2013 00:17:55 GMT

They are about 100MB each.

Re: Bundle Replication Issue

ShaneNewman — Sun, 24 Nov 2013 19:42:51 GMT

I found the issue after getting into the searchpeers folder. Turns out that we had someone from their desktop connecting to the indexer pool and sending a bundle about 600MB every 5 minutes.