All Apps and Add-ons

TimeClusterServicesAvailability.csv is huge in Vmware app

Explorer

Hello everyone, i'm using splunk 6.2 and vmware 3.1
VMWare app comes with SA-VMW-HierarchyInventory, which produces a csv called TimeClusterServicesAvailability.csv.
This file is huge, around 800MB. Is there a reason for that? Is there something i can setup to reduce this filesize?

Why am i bothering :
i'm having a "Bundle replication fails" error. the splunkd.log says : replicating takes too long, and the bundle size is around 900MB.
I'm was trying to reduce the bundle size and searched for big file using :
find /opt/splunk/etc/ -type f -size +100000k -exec ls -lh {} \; | awk '{ print $9 ": " $5 }'
=>i found this file to be responsible.

Now i don't know how to fix this file...
Is there any Vmware app expert around?
Regards,

1 Solution

Splunk Employee
Splunk Employee

So without knowing the underpinnings of the VMware App csv lookups usage - you could "try" to blacklist that csv file from being replicated by putting it inside the distsearch.conf file under the [replicationBlacklist] section. I say "try" because I don't know for sure if that will break search on the indexers. Also not knowing the format per say, but you can also look inside the csv and prune out old data if it has existed for a long time.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

So without knowing the underpinnings of the VMware App csv lookups usage - you could "try" to blacklist that csv file from being replicated by putting it inside the distsearch.conf file under the [replicationBlacklist] section. I say "try" because I don't know for sure if that will break search on the indexers. Also not knowing the format per say, but you can also look inside the csv and prune out old data if it has existed for a long time.

View solution in original post

0 Karma

Explorer

I forgot to mention : i did try to remove the search peer, reconfigure and reboot. I also iperf the network : 3.5Gb/s, no issue there.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!