I have a Splunk 4.2.4 search-head and indexer on another machine in a distributed setup.
I'm getting an error in my splunkd.log about my knowledge bundle timing out replicating from search-head to indexer.
I've tried the following in my distsearch.conf:
allConf = *.conf
allSpec = *.spec
Based on the Splunk docs. Looking in $SPLUNK_HOME/var/run/searchpeers/(latest).bundle on the indexer i see all sorts of files in the tarball not just the ones i've allowed via my whitelist.
I've restarted both search-head & indexer and am not sure what to try next? Do i also need a global blacklist?
I managed to fix the above problem after realising the regex's need the full path to the offending large files.
*.conf seems to only match in the root-level directories ($SPLUNK_HOME/etc /users /etc/apps, etc..)
Something like (i had a large lookup list in my Google Maps and MAXMIND app (the geoip DB)):
AppMapsCSV = maps/local/*.csv
AppMaxMindCSV = MAXMIND/local/*.csv
Did the trick, which significantly dropped my knowledge bundle size to something more manageable.
Hope it helps someone 🙂
View solution in original post