Deployment Architecture

Distributed Search Knowledge Bundle Regex

Splunker
Communicator

Folks,

I have a Splunk 4.2.4 search-head and indexer on another machine in a distributed setup.

I'm getting an error in my splunkd.log about my knowledge bundle timing out replicating from search-head to indexer.

I've tried the following in my distsearch.conf:

[replicationWhitelist]
allConf = *.conf
allSpec = *.spec

Based on the Splunk docs. Looking in $SPLUNK_HOME/var/run/searchpeers/(latest).bundle on the indexer i see all sorts of files in the tarball not just the ones i've allowed via my whitelist.

I've restarted both search-head & indexer and am not sure what to try next? Do i also need a global blacklist?

Thanks.

Tags (1)
0 Karma
1 Solution

Splunker
Communicator

I managed to fix the above problem after realising the regex's need the full path to the offending large files.

*.conf seems to only match in the root-level directories ($SPLUNK_HOME/etc /users /etc/apps, etc..)

Something like (i had a large lookup list in my Google Maps and MAXMIND app (the geoip DB)):

[replicationBlacklist]
AppMapsCSV = maps/local/*.csv
AppMaxMindCSV = MAXMIND/local/*.csv

Did the trick, which significantly dropped my knowledge bundle size to something more manageable.

Hope it helps someone 🙂

View solution in original post

Splunker
Communicator

I managed to fix the above problem after realising the regex's need the full path to the offending large files.

*.conf seems to only match in the root-level directories ($SPLUNK_HOME/etc /users /etc/apps, etc..)

Something like (i had a large lookup list in my Google Maps and MAXMIND app (the geoip DB)):

[replicationBlacklist]
AppMapsCSV = maps/local/*.csv
AppMaxMindCSV = MAXMIND/local/*.csv

Did the trick, which significantly dropped my knowledge bundle size to something more manageable.

Hope it helps someone 🙂

Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...