topic Re: Splunk says bundle directory contains a large lookup file in .delta file but the .delta file does not contain a large lookup in Splunk Search

Splunk says bundle directory contains a large lookup file in .delta file but the .delta file does not contain a large lookup

fboeje — Wed, 13 May 2020 15:46:03 GMT

Hi all,

We receive the warning : The current bundle directory contains a large lookup file that might cause bundle replication fail. The path to the directory is /opt/splunk/var/run/68DAE477-6A5A-40C6-A7CE-3778404DF158-1589383658-1589383891.delta
When looking into this .delta file it contains a few lookupfiles but they are only a few MB's. Also the full bundle files do not contain large lookups, we already blacklisted some large lookupfiles.

Re: Splunk says bundle directory contains a large lookup file in .delta file but the .delta file does not contain a large lookup

harsmarvania57 — Thu, 14 May 2020 11:32:27 GMT

Have a look at any other content in that delta file which might be bigger. If you can't see any big files in delta file then can you please let us know what is your .bundle size and .delta size ?

Re: Splunk says bundle directory contains a large lookup file in .delta file but the .delta file does not contain a large lookup

ragedsparrow — Tue, 19 May 2020 19:47:07 GMT

If you're on a Unix platoform, here is the oneliner that I use:

tar tvf <bundlelocation/bundle.bundle> | awk -v size="$size" '$3 >= size {print $3" "$6}'   | sort -t' ' -k1,1nr > /tmp/bundle.log; less /tmp/bundle.log

This is how I've troubleshoot bundle issues and to find out if there is something that I need to blacklist.

Re: Splunk says bundle directory contains a large lookup file in .delta file but the .delta file does not contain a large lookup

fboeje — Fri, 22 May 2020 06:30:50 GMT

Thanks. At this moment the messages disappeared. So I still dont know what caused the messages and what made them disappear.

Re: Splunk says bundle directory contains a large lookup file in .delta file but the .delta file does not contain a large lookup

fboeje — Fri, 22 May 2020 06:31:54 GMT

Thanks. I did exactly that check but there were no large files in the bundle. At this moment the messages disappeared. So I still dont know what caused the messages and what made them disappear.

Re: Splunk says bundle directory contains a large lookup file in .delta file but the .delta file does not contain a larg

_joe — Mon, 18 Jul 2022 12:27:58 GMT

Something like this would work best:

index = _internal sourcetype = splunkd component=Archiver Archiving large_file=* | stats count latest(size_in_bytes) by large_file

Re: Splunk says bundle directory contains a large lookup file in .delta file but the .delta file does not contain a larg

Huu-Nguyen — Thu, 23 Mar 2023 03:23:06 GMT

Thanks so much. This worked for me. I removed that lookup file (~1GB), all good now.