Deployment Architecture

Why do I often see error "Asynchronous bundle replication to 2 peer(s) succeeded; however it took too long..." and how do I fix this?

splunkdevabhi
Explorer

I see these bundle replication errors very often. Is there a solution or workaround?

02-15-2016 22:56:38.636 -0800 ERROR DistributedBundleReplicationManager - Unexpected problem while uploading bundle: Unknown write error
02-15-2016 22:56:38.636 -0800 ERROR DistributedBundleReplicationManager - Unable to upload bundle to peer named xyz with uri=https://xx.xx.xx.xx:8089.
02-15-2016 22:56:38.637 -0800 WARN  DistributedBundleReplicationManager - Asynchronous bundle replication to 2 peer(s) succeeded; however it took too long (longer than 10 seconds): elapsed_ms=37649, tar_elapsed_ms=23682, bundle_file_size=939470KB, replication_id=1455605760, replication_reason="async replication allowed"
1 Solution

DavidHourani
Super Champion

Some suggestions:

1- Check the permissions of your bundle files to make sure your SH can access and push them.
2- Make sure your bundle doesn't exceed the limit (In your logs I see that the size is 939470KB, default size is 800MB so you're exceeding it).
3- Make sure you check the content of your bundle using the ID.

Regards,
David

View solution in original post

DavidHourani
Super Champion

Some suggestions:

1- Check the permissions of your bundle files to make sure your SH can access and push them.
2- Make sure your bundle doesn't exceed the limit (In your logs I see that the size is 939470KB, default size is 800MB so you're exceeding it).
3- Make sure you check the content of your bundle using the ID.

Regards,
David

lycollicott
Motivator

Is your bundle being sent to a remote site across a site-to-site VPN tunnel?

0 Karma

DavidHourani
Super Champion

Any solution ? im having the same problem..

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...