During our deployment I have been noticing files being created along with .delta and .bundles called .candidate. I've been looking through the documentation but I can't seem to find what this file is and contians.
Candidate bundles are created every replication_period_sec by:
1.Iterating through $SPLUNK_HOME/etc
2.Checking each item against the blacklist
3.Checking each item against the whitelist
4.No match? Drop it.
Candidate bundle is compared to the existing bundle and distributed if necessary, MD5 of candidate and previous bundle is compared
Hope the above helps!