Why is my distsearch.conf replicationBlacklist configuration not being applied?

[msarro]

Hey everyone. Our search head pool is trying to push down a 900MB+ knowledge bundle, and we are trying to fix the issue. The main problem is the splunk for windows app - it has generated a file called windows_perfmon_details.csv which is about 890MB (we have several hundred windows boxes).

This obviously doesn't need to be replicated down.

I have created an app and placed it on all of our search heads, and restarted. In the app is a distsearch.conf file containing the following:

[replicationBlacklist]
winLookup = *windows_perfmon_details.csv

When I check with btool, I can see that the blacklist has been loaded under the replicationBlacklist stanza.

However, my bundles still seem to contain the offending file, so I keep getting:

Unable to distribute to peer named MYINDEXER at uri MYINDEXER:8089 because replication was unsuccessful. replicationStatus Failed

Is there an issue with my regex? Is there another step I am missing here?

[jkat54 · Accepted solution]

 "*" doesn't recurse directories, you want "..." instead:


[replicationBlacklist]
 winLookup = ...windows_perfmon_details.csv

Not

 [replicationBlacklist]
 winLookup = *windows_perfmon_details.csv

[benlc]

like this:

[replicationBlacklist]
whatever = apps/app_name/lookups/file.csv

[jkat54]

i believe he wanted a wild card in there somewhere benic

[dmenon84]

Did you find solution for your question?

[jkat54]

How many accounts do you have dmenon?