Alerting

Alert for "Problem replicating config (bundle)"

hartfoml
Motivator

I would like to know when a web:ui user get a bundle replication error. does anyone know where can I look to setup an alert so that I get an email every time this error is shown to the users?

Tags (2)
0 Karma

rtadams89
Contributor

You can find these events in the _internal index.

hartfoml
Motivator

Sorry I am on version 4.3.1 and these logs are not recorded in any index that I can find.

0 Karma

rtadams89
Contributor

Try searching for:

index=_internal component=DistributedPeerManager

This should show you all the bundle replication events. You can further refine this to:

index=_internal component=DistributedPeerManager "replication was unsuccessful"

Which will show you the failures.

0 Karma

hartfoml
Motivator

ya thanks, Thanks was the first place I looked but could not find them in there. Thanks anyway.

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...