topic Re: The current bundle directory contains a large lookup file that might cause bundle replication fail - delta in Splunk Search

How to resolve:The current bundle directory contains a large lookup file that might cause bundle replication fail- delta

daisy — Fri, 24 Jun 2022 15:46:42 GMT

Hi all,

I keep getting a message that the current bundle directory contains a large lookup file and the specified file is a delta under /opt/splunk/var/run. I read that the max_memtable_bytes determines the maximum size of lookups. But how about the delta? What delta size is too large? Or should I rather be looking at the largest lookups in the bundle to resolve the problem? Do you have any tipps on how to resolve this?Thanks.

Re: The current bundle directory contains a large lookup file that might cause bundle replication fail - delta

gcusello — Fri, 24 Jun 2022 07:17:03 GMT

Hi @daisy,

you could enlarge this parameter in limits.conf, but I think that the best solution is to blacklist this lookup in bundle, you can do this following the instructions at https://docs.splunk.com/Documentation/Splunk/9.0.0/DistSearch/Limittheknowledgebundlesize#Eliminate_files_from_the_knowledge_bundle

Ciao.

Giuseppe

Re: The current bundle directory contains a large lookup file that might cause bundle replication fail - delta

daisy — Fri, 24 Jun 2022 08:12:57 GMT

Hi Giuseppe @gcusello,

my problem is rather that the delta is shown in the message, not the bundle. So my question is - should I look for a big file in the delta and what is considered a bid file for the delta? Or should I still look for big files in the bundle? I can't identify which file is causing the problem.

Thanks,

Daisy

Re: The current bundle directory contains a large lookup file that might cause bundle replication fail - delta

gcusello — Fri, 24 Jun 2022 08:20:41 GMT

Hi @daisy,

in the message you should have the indication of the too large bundle, anyway, you could see in the Search Head Captain, the dimension of each app and find the too large bundle.

ciao.

Giuseppe

Re: The current bundle directory contains a large lookup file that might cause bundle replication fail - delta

daisy — Fri, 24 Jun 2022 08:30:41 GMT

Hi gcusello,

only the delta is mentioned in the message. That's why I am bit confused - should I be looking at the bundle instead? The delta is just the new changes made, while the bundle contains all lookups, as far as I know.

Thanks,

Daisy

Re: The current bundle directory contains a large lookup file that might cause bundle replication fail - delta

isoutamo — Fri, 24 Jun 2022 08:34:16 GMT

even the SH normally sends only delta there will be a situations when it needs to send the whole lookup. If it cannot sent even delta how it can send the whole lookup? Or if the delta is actually the whole lookup? For that reason I’m totally agree with @gcusello what is the best way to go forward.

r. Ismo