https://community.splunk.com/t5/Getting-Data-In/How-often-does-the-search-head-send-the-knowledge-bundles-to-the/m-p/166246#M33717 <P>My indexer has <CODE>/opt/splunk/var/run/searchpeers</CODE>.<BR /> How often do searchpeers get updated?<BR /> I also have an old backup searchpeers.bak which is occupying space.<BR /> So, can I remove searchpeers.bak?</P> Mon, 27 Apr 2015 06:04:24 GMT sarnagar 2015-04-27T06:04:24Z https://community.splunk.com/t5/Getting-Data-In/How-often-does-the-search-head-send-the-knowledge-bundles-to-the/m-p/166246#M33717 <P>My indexer has <CODE>/opt/splunk/var/run/searchpeers</CODE>.<BR /> How often do searchpeers get updated?<BR /> I also have an old backup searchpeers.bak which is occupying space.<BR /> So, can I remove searchpeers.bak?</P> Mon, 27 Apr 2015 06:04:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-often-does-the-search-head-send-the-knowledge-bundles-to-the/m-p/166246#M33717 sarnagar 2015-04-27T06:04:24Z https://community.splunk.com/t5/Getting-Data-In/How-often-does-the-search-head-send-the-knowledge-bundles-to-the/m-p/166247#M33718 <P>Hi,<BR /> Haven't deleted that info, but I think it would<BR /> get replicated again...since bundle won't get overwritten when<BR /> Splunk is upgraded. </P> <P>you can reduce the size of the bundle by means of the<BR /> [replicationWhitelist] or [replicationBlacklist] stanza in<BR /> distsearch.conf . See "Modify the knowledge bundle" in the deployment manual.</P> <P>docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/Limittheknowledgebundlesize</P> Mon, 27 Apr 2015 06:47:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-often-does-the-search-head-send-the-knowledge-bundles-to-the/m-p/166247#M33718 stephane_cyrill 2015-04-27T06:47:53Z