Hi all, I wanted to set up an alert to monitor the bundle size if the size is about to reach the limit. I am able to get the "max_content_length" for all indexers from a rest call, but I am unable to get the bundle size across all my indexers over time. Any clues?
The above search does only appear if the distribution took longer than 10s or 10'000ms. Is there a way to know/get the bundle size even there is no WARN-message? Did somebody figure this.
Thanks for your help.
If you meant the Search Head bundle that gets distributed to all the peers, you can try something like below. Depending on the version you are running the component name might slightly differ
index=_internal sourcetype=splunkd component=DistributedBundleReplicationManager bundle_size=* | eval bfs=rtrim(bundle_size, "KB") | eval bundle_size_MB = bfs/1024 |timechart span=15m avg(bundle_size_MB) max(bundle_size_MB)by host