Splunk Search

How to track the bundle size on indexers over time

splunkrocks2014
Communicator

Hi all, I wanted to set up an alert to monitor the bundle size if the size is about to reach the limit. I am able to get the "max_content_length" for all indexers from a rest call, but I am unable to get the bundle size across all my indexers over time. Any clues?

Thanks.

Tags (1)
0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

Try using the rest api to get the bundle size:

| rest splunk_server=local /services/search/distributed/bundle-replication-files | table size

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

if you want to track over time, collect the timestamp and size fields on some regular basis and output to a lookup or csv file

0 Karma

benlc
Path Finder

The above search does only appear if the distribution took longer than 10s or 10'000ms. Is there a way to know/get the bundle size even there is no WARN-message? Did somebody figure this.

Thanks for your help.

0 Karma

pradeepkumarg
Influencer

If you meant the Search Head bundle that gets distributed to all the peers, you can try something like below. Depending on the version you are running the component name might slightly differ

index=_internal sourcetype=splunkd component=DistributedBundleReplicationManager bundle_size=* | eval bfs=rtrim(bundle_size, "KB") | eval bundle_size_MB = bfs/1024 |timechart span=15m avg(bundle_size_MB) max(bundle_size_MB)by host

splunkrocks2014
Communicator

Hi. I am only able to see the bundle size from my search heads, but none of them are from the indexers.

0 Karma

pradeepkumarg
Influencer

Those are the same bundles that go to the indexers..

0 Karma

splunkrocks2014
Communicator

I got the bundle size when run the search on DMC. I wonder why I got different max(bundle_size_MB) across all the indexers. Is it expected?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...