All Apps and Add-ons
Highlighted

TimeClusterServicesAvailability.csv is huge in Vmware app

Explorer

Hello everyone, i'm using splunk 6.2 and vmware 3.1
VMWare app comes with SA-VMW-HierarchyInventory, which produces a csv called TimeClusterServicesAvailability.csv.
This file is huge, around 800MB. Is there a reason for that? Is there something i can setup to reduce this filesize?

Why am i bothering :
i'm having a "Bundle replication fails" error. the splunkd.log says : replicating takes too long, and the bundle size is around 900MB.
I'm was trying to reduce the bundle size and searched for big file using :
find /opt/splunk/etc/ -type f -size +100000k -exec ls -lh {} \; | awk '{ print $9 ": " $5 }'
=>i found this file to be responsible.

Now i don't know how to fix this file...
Is there any Vmware app expert around?
Regards,

Highlighted

Re: TimeClusterServicesAvailability.csv is huge in Vmware app

Explorer

I forgot to mention : i did try to remove the search peer, reconfigure and reboot. I also iperf the network : 3.5Gb/s, no issue there.

0 Karma
Highlighted

Re: TimeClusterServicesAvailability.csv is huge in Vmware app

Splunk Employee
Splunk Employee

So without knowing the underpinnings of the VMware App csv lookups usage - you could "try" to blacklist that csv file from being replicated by putting it inside the distsearch.conf file under the [replicationBlacklist] section. I say "try" because I don't know for sure if that will break search on the indexers. Also not knowing the format per say, but you can also look inside the csv and prune out old data if it has existed for a long time.

View solution in original post

0 Karma