Deployment Architecture

Can you help us with understand how Splunk manages bundles?

a212830
Champion

Hi,

Our Splunk system was down this morning, and we noticed that the issue was that lots of bundles were being generated and kept on the search-heads (the problem was not due to overly large bundles). We also had two indexer problem, one where /opt/splunk/var was running out of space and another that was unreachable due to network issues.

I have some questions on how Splunk manages bundles:

1) What happens if a search-peer is down/unreachable? Will splunk try to keep sending the bundle? Will it keep a copy of that bundle until it can send it?

2) Is there a way to limit how many bundles the search-heads keep?
3) Is there a way to limit the size of the bundles?

4) Is there a way to limit how often bundles get created? Are there any cons to limiting how often they get created?

1 Solution

DavidHourani
Super Champion

Hi There,

1) What happens if a search-peer is down/unreachable? Will splunk try to keep sending the bundle? Will it keep a copy of that bundle until it can send it?
Doesn't keep trying the send the bundle, only sends it when you run a search and peer requires bundle, in that case it's sent to all active peers. More info here : http://docs.splunk.com/Documentation/Splunk/7.2.0/DistSearch/Whatsearchheadssend
2) Is there a way to limit how many bundles the search-heads keep?
No.
3) Is there a way to limit the size of the bundles?
Yes, you can do that by limiting the number of files included in the bundle. More info here:
http://docs.splunk.com/Documentation/Splunk/7.2.0/DistSearch/Limittheknowledgebundlesize
4) Is there a way to limit how often bundles get created? Are there any cons to limiting how often they get created?
No.
Have a look at this answer too, could be helpful : https://answers.splunk.com/answers/458837/how-do-bundles-work.html
And this conf talk : https://conf.splunk.com/files/2017/slides/pushing-configuration-bundles-in-an-indexer-cluster.pdf

Cheers,
David

View solution in original post

DavidHourani
Super Champion

Hi There,

1) What happens if a search-peer is down/unreachable? Will splunk try to keep sending the bundle? Will it keep a copy of that bundle until it can send it?
Doesn't keep trying the send the bundle, only sends it when you run a search and peer requires bundle, in that case it's sent to all active peers. More info here : http://docs.splunk.com/Documentation/Splunk/7.2.0/DistSearch/Whatsearchheadssend
2) Is there a way to limit how many bundles the search-heads keep?
No.
3) Is there a way to limit the size of the bundles?
Yes, you can do that by limiting the number of files included in the bundle. More info here:
http://docs.splunk.com/Documentation/Splunk/7.2.0/DistSearch/Limittheknowledgebundlesize
4) Is there a way to limit how often bundles get created? Are there any cons to limiting how often they get created?
No.
Have a look at this answer too, could be helpful : https://answers.splunk.com/answers/458837/how-do-bundles-work.html
And this conf talk : https://conf.splunk.com/files/2017/slides/pushing-configuration-bundles-in-an-indexer-cluster.pdf

Cheers,
David

bkirk
Path Finder

I think we had this same problem. Please check this thread out it seemed to help us:

https://answers.splunk.com/answers/151428/how-to-prevent-internal-splunk-audit-logs-from-being-writt...

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...