topic Re: Bundle Replication in Splunk in Splunk Search

Bundle Replication in Splunk

Arun_N_007 — Fri, 22 May 2015 07:33:04 GMT

What is Bundle Replication in Splunk? How it works in Search Head and Indexer?

In below link they explained about search flow in Splunk.

http://wiki.splunk.com/images/2/2a/Splunk_SearchFlow_v05_01.jpg

How to get the whole search transaction flow in _internal Index Using Splunk Query??

Re: Bundle Replication in Splunk

emiller42 — Fri, 22 May 2015 14:08:44 GMT

I would recommend reading the following for instructions on how to set up distributed search:

http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Overviewofconfiguration

Re: Bundle Replication in Splunk

woodcock — Sat, 23 May 2015 02:52:52 GMT

Bundle replication refers to the fact that Splunk will take the relevant knowledge objects (e.g. lookups, field extractsions, etc.) that exist on the Search Head where you are running your search and which apply to your search and "bundle" them up in order to distribute them to the search peers (Indexers) that will be running the map-reduced searches. In older versions of Splunk, the admin had to make sure that these knowledge objects had to be installed directly to each search peer and if this was not done correctly, the searches would not be run correctly and the search results would be wrong.

Re: Bundle Replication in Splunk

Arun_N_007 — Sat, 23 May 2015 19:24:47 GMT

Thank you woodcock. Can you provide the link which explains better in Splunk docs???

Re: Bundle Replication in Splunk

woodcock — Sun, 24 May 2015 01:01:51 GMT