Deployment Architecture

Why is my distsearch.conf replicationBlacklist configuration not being applied?

msarro
Builder

Hey everyone. Our search head pool is trying to push down a 900MB+ knowledge bundle, and we are trying to fix the issue. The main problem is the splunk for windows app - it has generated a file called windows_perfmon_details.csv which is about 890MB (we have several hundred windows boxes).

This obviously doesn't need to be replicated down.

I have created an app and placed it on all of our search heads, and restarted. In the app is a distsearch.conf file containing the following:

[replicationBlacklist]
winLookup = *windows_perfmon_details.csv

When I check with btool, I can see that the blacklist has been loaded under the replicationBlacklist stanza.

However, my bundles still seem to contain the offending file, so I keep getting:

Unable to distribute to peer named MYINDEXER at uri MYINDEXER:8089 because replication was unsuccessful. replicationStatus Failed

Is there an issue with my regex? Is there another step I am missing here?

1 Solution

jkat54
SplunkTrust
SplunkTrust
 "*" doesn't recurse directories, you want "..." instead:


[replicationBlacklist]
 winLookup = ...windows_perfmon_details.csv

Not

 [replicationBlacklist]
 winLookup = *windows_perfmon_details.csv

View solution in original post

jkat54
SplunkTrust
SplunkTrust
 "*" doesn't recurse directories, you want "..." instead:


[replicationBlacklist]
 winLookup = ...windows_perfmon_details.csv

Not

 [replicationBlacklist]
 winLookup = *windows_perfmon_details.csv

View solution in original post

benlc
Path Finder

like this:

[replicationBlacklist]
whatever = apps/app_name/lookups/file.csv
0 Karma

jkat54
SplunkTrust
SplunkTrust

i believe he wanted a wild card in there somewhere benic

0 Karma

dmenon84
Path Finder

Did you find solution for your question?

0 Karma

jkat54
SplunkTrust
SplunkTrust

How many accounts do you have dmenon?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!