Deployment Architecture

Why do I often see error "Asynchronous bundle replication to 2 peer(s) succeeded; however it took too long..." and how do I fix this?

splunkdevabhi
Explorer

I see these bundle replication errors very often. Is there a solution or workaround?

02-15-2016 22:56:38.636 -0800 ERROR DistributedBundleReplicationManager - Unexpected problem while uploading bundle: Unknown write error
02-15-2016 22:56:38.636 -0800 ERROR DistributedBundleReplicationManager - Unable to upload bundle to peer named xyz with uri=https://xx.xx.xx.xx:8089.
02-15-2016 22:56:38.637 -0800 WARN  DistributedBundleReplicationManager - Asynchronous bundle replication to 2 peer(s) succeeded; however it took too long (longer than 10 seconds): elapsed_ms=37649, tar_elapsed_ms=23682, bundle_file_size=939470KB, replication_id=1455605760, replication_reason="async replication allowed"
1 Solution

DavidHourani
Super Champion

Some suggestions:

1- Check the permissions of your bundle files to make sure your SH can access and push them.
2- Make sure your bundle doesn't exceed the limit (In your logs I see that the size is 939470KB, default size is 800MB so you're exceeding it).
3- Make sure you check the content of your bundle using the ID.

Regards,
David

View solution in original post

DavidHourani
Super Champion

Some suggestions:

1- Check the permissions of your bundle files to make sure your SH can access and push them.
2- Make sure your bundle doesn't exceed the limit (In your logs I see that the size is 939470KB, default size is 800MB so you're exceeding it).
3- Make sure you check the content of your bundle using the ID.

Regards,
David

lycollicott
Motivator

Is your bundle being sent to a remote site across a site-to-site VPN tunnel?

0 Karma

DavidHourani
Super Champion

Any solution ? im having the same problem..

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...