https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302174#M165721 <P>Try using the rest api to get the bundle size:</P> <P>| rest splunk_server=local /services/search/distributed/bundle-replication-files | table size</P> Mon, 14 Oct 2019 19:02:33 GMT sjohnson_splunk 2019-10-14T19:02:33Z https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302168#M165715 <P>Hi all, I wanted to set up an alert to monitor the bundle size if the size is about to reach the limit. I am able to get the "max_content_length" for all indexers from a rest call, but I am unable to get the bundle size across all my indexers over time. Any clues? </P> <P>Thanks.</P> Tue, 29 Sep 2020 16:13:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302168#M165715 splunkrocks2014 2020-09-29T16:13:18Z https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302169#M165716 <P>If you meant the Search Head bundle that gets distributed to all the peers, you can try something like below. Depending on the version you are running the component name might slightly differ</P> <PRE> index=_internal sourcetype=splunkd component=DistributedBundleReplicationManager bundle_size=* | eval bfs=rtrim(bundle_size, "KB") | eval bundle_size_MB = bfs/1024 |timechart span=15m avg(bundle_size_MB) max(bundle_size_MB)by host </PRE> Tue, 10 Oct 2017 17:05:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302169#M165716 pradeepkumarg 2017-10-10T17:05:00Z https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302170#M165717 <P>Hi. I am only able to see the bundle size from my search heads, but none of them are from the indexers.</P> Tue, 10 Oct 2017 17:35:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302170#M165717 splunkrocks2014 2017-10-10T17:35:59Z https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302171#M165718 <P>Those are the same bundles that go to the indexers.. </P> Tue, 10 Oct 2017 20:48:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302171#M165718 pradeepkumarg 2017-10-10T20:48:17Z https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302172#M165719 <P>I got the bundle size when run the search on DMC. I wonder why I got different max(bundle_size_MB) across all the indexers. Is it expected?</P> Tue, 29 Sep 2020 16:13:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302172#M165719 splunkrocks2014 2020-09-29T16:13:36Z https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302173#M165720 <P>The above search does only appear if the distribution took longer than 10s or 10'000ms. Is there a way to know/get the bundle size even there is no WARN-message? Did somebody figure this.</P> <P>Thanks for your help.</P> Wed, 03 Jan 2018 09:47:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302173#M165720 benlc 2018-01-03T09:47:24Z https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302174#M165721 <P>Try using the rest api to get the bundle size:</P> <P>| rest splunk_server=local /services/search/distributed/bundle-replication-files | table size</P> Mon, 14 Oct 2019 19:02:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302174#M165721 sjohnson_splunk 2019-10-14T19:02:33Z https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302175#M165722 <P>if you want to track over time, collect the timestamp and size fields on some regular basis and output to a lookup or csv file</P> Mon, 14 Oct 2019 19:04:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-the-bundle-size-on-indexers-over-time/m-p/302175#M165722 sjohnson_splunk 2019-10-14T19:04:58Z