All Apps and Add-ons

TimeClusterServicesAvailability.csv is huge in Vmware app

sd100
Explorer

Hello everyone, i'm using splunk 6.2 and vmware 3.1
VMWare app comes with SA-VMW-HierarchyInventory, which produces a csv called TimeClusterServicesAvailability.csv.
This file is huge, around 800MB. Is there a reason for that? Is there something i can setup to reduce this filesize?

Why am i bothering :
i'm having a "Bundle replication fails" error. the splunkd.log says : replicating takes too long, and the bundle size is around 900MB.
I'm was trying to reduce the bundle size and searched for big file using :
find /opt/splunk/etc/ -type f -size +100000k -exec ls -lh {} \; | awk '{ print $9 ": " $5 }'
=>i found this file to be responsible.

Now i don't know how to fix this file...
Is there any Vmware app expert around?
Regards,

1 Solution

mgildenhorn_spl
Splunk Employee
Splunk Employee

So without knowing the underpinnings of the VMware App csv lookups usage - you could "try" to blacklist that csv file from being replicated by putting it inside the distsearch.conf file under the [replicationBlacklist] section. I say "try" because I don't know for sure if that will break search on the indexers. Also not knowing the format per say, but you can also look inside the csv and prune out old data if it has existed for a long time.

View solution in original post

0 Karma

mgildenhorn_spl
Splunk Employee
Splunk Employee

So without knowing the underpinnings of the VMware App csv lookups usage - you could "try" to blacklist that csv file from being replicated by putting it inside the distsearch.conf file under the [replicationBlacklist] section. I say "try" because I don't know for sure if that will break search on the indexers. Also not knowing the format per say, but you can also look inside the csv and prune out old data if it has existed for a long time.

0 Karma

sd100
Explorer

I forgot to mention : i did try to remove the search peer, reconfigure and reboot. I also iperf the network : 3.5Gb/s, no issue there.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>