Deployment Architecture

Why is my distsearch.conf replicationBlacklist configuration not being applied?

msarro
Builder

Hey everyone. Our search head pool is trying to push down a 900MB+ knowledge bundle, and we are trying to fix the issue. The main problem is the splunk for windows app - it has generated a file called windows_perfmon_details.csv which is about 890MB (we have several hundred windows boxes).

This obviously doesn't need to be replicated down.

I have created an app and placed it on all of our search heads, and restarted. In the app is a distsearch.conf file containing the following:

[replicationBlacklist]
winLookup = *windows_perfmon_details.csv

When I check with btool, I can see that the blacklist has been loaded under the replicationBlacklist stanza.

However, my bundles still seem to contain the offending file, so I keep getting:

Unable to distribute to peer named MYINDEXER at uri MYINDEXER:8089 because replication was unsuccessful. replicationStatus Failed

Is there an issue with my regex? Is there another step I am missing here?

1 Solution

jkat54
SplunkTrust
SplunkTrust
 "*" doesn't recurse directories, you want "..." instead:


[replicationBlacklist]
 winLookup = ...windows_perfmon_details.csv

Not

 [replicationBlacklist]
 winLookup = *windows_perfmon_details.csv

View solution in original post

jkat54
SplunkTrust
SplunkTrust
 "*" doesn't recurse directories, you want "..." instead:


[replicationBlacklist]
 winLookup = ...windows_perfmon_details.csv

Not

 [replicationBlacklist]
 winLookup = *windows_perfmon_details.csv

benlc
Path Finder

like this:

[replicationBlacklist]
whatever = apps/app_name/lookups/file.csv
0 Karma

jkat54
SplunkTrust
SplunkTrust

i believe he wanted a wild card in there somewhere benic

0 Karma

dmenon84
Path Finder

Did you find solution for your question?

0 Karma

jkat54
SplunkTrust
SplunkTrust

How many accounts do you have dmenon?

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...