Deployment Architecture

What is a .candidate file for in the splunk deployer process?

danman06
Explorer

During our deployment I have been noticing files being created along with .delta and .bundles called .candidate. I've been looking through the documentation but I can't seem to find what this file is and contians.

Tags (1)
0 Karma

mbadhusha_splun
Splunk Employee
Splunk Employee

Candidate bundles are created every replication_period_sec by:

1.Iterating through $SPLUNK_HOME/etc
2.Checking each item against the blacklist
3.Checking each item against the whitelist
4.No match? Drop it.

Candidate bundle is compared to the existing bundle and distributed if necessary, MD5 of candidate and previous bundle is compared

Hope the above helps!

Cheers.

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...