All Apps and Add-ons

Knowledge bundles and deployed apps

rtadams89
Contributor

If I have an app that contains lookup tables installed on my search heads AND on my indexers, can I blacklist that app from being replicated in the knowledge bundle (to reduce the bundle size)? It would seem that if the same lookup apps exist on both the search head and indexer, there would be no need to replicate the same data again from from search head to indexer...

Tags (1)
0 Karma

kaufmanm
Communicator

I don't know that this will work if you need to use the lookup on the search nodes, but I think it's your best bet, so I'd try it out and see what happens. On the search head, edit distsearch.conf and add the below stanza:

[replicationBlacklist]
large_lookup = name_of_lookup_file.csv

Then restart Splunk on the search head and see if the searches you need still work.

Source: Splunk docs

0 Karma

rtadams89
Contributor

I'm trying this now, but due to the number of apps and the variety of things I would like to blacklist (e.g., in addition to the lookup files, there are a bunch of bat/py/sh scripts, props/transforms .conf files, etc.) I'm not sure I can test all potential issues.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...