Deployment Architecture
Highlighted

## How do bundles work with the forwarders?

Ultra Champion

All along we spoke about bundles on the indexers and SHs, but yesterday my colleague mentioned to me that they are used also with the forwarders. I believe the bundles reside at `C:\opt\splunk\splunkforwarder\var\run` on our windows forwarders.

Tags (2)
Highlighted

## Re: How do bundles work with the forwarders?

SplunkTrust

The bundles sent from search head to indexer are not sent anywhere else.
Search heads do not communicate with forwarders.
Forwarders send data to indexers, but that is not a "bundle".
Deployment Servers (which can be part of an SH instance) communicate with forwarders to tell them which apps to download. These are not "bundles", either.

---
If this reply helps you, an upvote would be appreciated.
Highlighted

## Re: How do bundles work with the forwarders?

Ultra Champion

Not sure about the terminology but I see the following -

``````/monitor/splunkforwarder-linux/var/run/<app>
\$ \ls -tlr
total 1252
-rw-------. 1 splunknu dce 1239040 May 16 11:15 Splunk_TA_nix-1558023151.bundle
-rw-------. 1 splunknu dce   40960 Jun 14 09:38 <app>-1560523046.bundle
``````

And by removing this `*.bundle` file, the deployment server sends a new one.

Highlighted

## Re: How do bundles work with the forwarders?

SplunkTrust

Those are the apps downloaded by the forwarder from the DS. They're not usually referred to as bundles, but I see that is what the forwarder calls them. Thanks for the education!

---
If this reply helps you, an upvote would be appreciated.
Highlighted

## Re: How do bundles work with the forwarders?

Ultra Champion

Thank you @richgalloway for all your help - it was interesting to see these `*.bundle` files on the forwarder ; -)

Highlighted

## Re: How do bundles work with the forwarders?

Ultra Champion

The following mentions the `*.bundle` files but not their `var/run/<app>` location - Extended example: Deploy configurations to several forwarders

In the page, we can search for `fwd_to_splunk1-timestamp.bundle`.