https://community.splunk.com/t5/Splunk-Search/Search-to-verify-bundle-delivered/m-p/22726#M3945 <P>index=_audit action=replication </P> <P>example event </P> <P>1:06:22.126 PM Audit:[timestamp=03-23-2010 13:06:22.126, user=admin, action=replication, info=Bundle replication to peer named class4.splunk.com at <A href="https://class4.splunk.com:8089" rel="nofollow">https://class4.splunk.com:8089</A> succeeded.][n/a]</P> Thu, 29 Jul 2010 22:40:49 GMT rroberts 2010-07-29T22:40:49Z https://community.splunk.com/t5/Splunk-Search/Search-to-verify-bundle-delivered/m-p/22725#M3944 <P>Is there a search to check bundles delivered from search head to peers?</P> Thu, 29 Jul 2010 22:40:10 GMT https://community.splunk.com/t5/Splunk-Search/Search-to-verify-bundle-delivered/m-p/22725#M3944 rroberts 2010-07-29T22:40:10Z https://community.splunk.com/t5/Splunk-Search/Search-to-verify-bundle-delivered/m-p/22726#M3945 <P>index=_audit action=replication </P> <P>example event </P> <P>1:06:22.126 PM Audit:[timestamp=03-23-2010 13:06:22.126, user=admin, action=replication, info=Bundle replication to peer named class4.splunk.com at <A href="https://class4.splunk.com:8089" rel="nofollow">https://class4.splunk.com:8089</A> succeeded.][n/a]</P> Thu, 29 Jul 2010 22:40:49 GMT https://community.splunk.com/t5/Splunk-Search/Search-to-verify-bundle-delivered/m-p/22726#M3945 rroberts 2010-07-29T22:40:49Z https://community.splunk.com/t5/Splunk-Search/Search-to-verify-bundle-delivered/m-p/22727#M3946 <P>Consider adding some pretty formatting to the search string <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 30 Jul 2010 23:34:15 GMT https://community.splunk.com/t5/Splunk-Search/Search-to-verify-bundle-delivered/m-p/22727#M3946 ftk 2010-07-30T23:34:15Z