Deployment Architecture

Should I be worried about these bundle replication messages??


Splunk Version 6.3.4
Search head cluster of 3 nodes
Indexer distributed search peers 4 nodes

I see the following error messages in _internal:

WARN DistBundleRestHandler - There was a problem renaming: /opt/splunk/var/run/searchpeers/F7521905-DA3E-4B9B-B2FE-08B911826B00-1465250902.b469fbba316fbf76.tmp -> /opt/splunkp/splunk/var/run/searchpeers/F7521905-DA3E-4B9B-B2FE-08B911826B00-1465250902: File exists 

ERROR DistBundleRestHandler - Problem untarring file: /opt/splunk/var/run/searchpeers/F7521905-DA3E-4B9B-B2FE-08B911826B00-1465250902.bundle 

WARN DistributedBundleReplicationManager - Asynchronous bundle replication to 4 peer(s) succeeded; however it took too long (longer than 10 seconds): elapsed_ms=48188, tar_elapsed_ms=10311, bundle_file_size=344190KB, replication_id=1465250902, replication_reason="async replication allowed"
0 Karma

Esteemed Legend

Yes, as your search load increases, the bundle size will too and that will be compounded by the higher workload, too. Eventually the bundle replications will timeout and fail completely and the searches that go with them will fail. For this reason, many people setup cron jobs to delete ANY file that is more than x (typically 7) days old in the dispatch directory. Many times old files from long-ago-useless |outputcsv commands can accumulate causing this problem.

0 Karma


alt text

0 Karma
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...