https://community.splunk.com/t5/Getting-Data-In/Blacklisting-certain-data-from-replicating-in-a-bundle/m-p/30043#M5210 <P>We are receiving replication failures several times a day between our searchhead and various indexers. From what I understand in distsearch.conf you can blacklist certain data from being replicated. Currently, we have over 100 jobs that run at various points throughout the night. Where can I start looking at within the jobs to see what I am able to blacklist? From what I understand, if a job only uses a specific indexer or search peer, we can tell that job to only replicate the searches needed to that specific search peer. Am I on track here? I am sure there is a lot of other data we can remove from the replication bundles as well.</P> Wed, 18 Apr 2012 19:28:21 GMT ride76 2012-04-18T19:28:21Z https://community.splunk.com/t5/Getting-Data-In/Blacklisting-certain-data-from-replicating-in-a-bundle/m-p/30043#M5210 <P>We are receiving replication failures several times a day between our searchhead and various indexers. From what I understand in distsearch.conf you can blacklist certain data from being replicated. Currently, we have over 100 jobs that run at various points throughout the night. Where can I start looking at within the jobs to see what I am able to blacklist? From what I understand, if a job only uses a specific indexer or search peer, we can tell that job to only replicate the searches needed to that specific search peer. Am I on track here? I am sure there is a lot of other data we can remove from the replication bundles as well.</P> Wed, 18 Apr 2012 19:28:21 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklisting-certain-data-from-replicating-in-a-bundle/m-p/30043#M5210 ride76 2012-04-18T19:28:21Z https://community.splunk.com/t5/Getting-Data-In/Blacklisting-certain-data-from-replicating-in-a-bundle/m-p/30044#M5211 <P>I am having the same issues in conjunction with Indexer timeouts. Does anyone have any input for this question? I'm extremely interested.</P> Thu, 06 Mar 2014 15:54:39 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklisting-certain-data-from-replicating-in-a-bundle/m-p/30044#M5211 ebdavis333 2014-03-06T15:54:39Z https://community.splunk.com/t5/Getting-Data-In/Blacklisting-certain-data-from-replicating-in-a-bundle/m-p/30045#M5212 <P>What's in the bundle?<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Whatsearchheadssend">http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Whatsearchheadssend</A></P> <P>blacklisting / whitelisting files in the bundle<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Limittheknowledgebundlesize">http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Limittheknowledgebundlesize</A></P> <P>Limiting the search peers (indexers) that your search runs on<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Distributedsearchgroups">http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Distributedsearchgroups</A></P> Thu, 26 Mar 2015 19:19:25 GMT https://community.splunk.com/t5/Getting-Data-In/Blacklisting-certain-data-from-replicating-in-a-bundle/m-p/30045#M5212 matt_harden 2015-03-26T19:19:25Z