6.1.3 issue with mounted Bundles

Following the upgrade from 6.1.1 to 6.1.3, we found that mounted bundles were having issues (configured using Our search head and indexers could not communicate to each other, with log entries like the following:

Search head:

08-14-2014 14:50:00.559 +0000 ERROR DistributedBundleReplicationManager - Unable to upload bundle to peer named splunk-indexerserver with uri=blah:8089.
08-14-2014 14:50:00.559 +0000 ERROR DistributedBundleReplicationManager - bundle size=1141MB, path=/opt/splunk/var/run/splunk-searchheadserver-1408027681.bundle, is too large for replication, maxsize=1024MB. Check for any large unwanted files in $SPLUNKHOME/etc/


08-14-2014 14:33:26.499 +0000 ERROR LMTracker - failed to send rows, reason='Unable to connect to remote peer: splunk-searchheadserver:8089 rc=2'

[will add answer separately]

0 Karma

Re: 6.1.3 issue with mounted Bundles

With 6.1.1, we didn't have "shareBundles=false" set in the local distsearch.conf. With the upgrade to 6.1.3, the default distsearch.conf file adds "shareBundles=true" which was the problem. When we added "shareBundles=false" to our local conf file, it fixed the issue.