Deployment Architecture

because of a symlink size of bundle file is 0 on searchhead in /opt/splunk/var/run/

imrago
Contributor

Hi,

I have a simple setup, one searchhead and one indexer. Starting from the latest upgrade to 4.2.4 the size of bundle file on the searchhead is always zero and it is not being replicated to the indexer.
How could I fix this or how could I find the cause of the problem?

Tags (2)
0 Karma
1 Solution

imrago
Contributor

I solved the problem by creating a blacklist for the directory containing the symlink, the following post helped me a lot:

http://splunk-base.splunk.com/answers/36774/distributed-search-knowledge-bundle-regex

View solution in original post

0 Karma

imrago
Contributor

I solved the problem by creating a blacklist for the directory containing the symlink, the following post helped me a lot:

http://splunk-base.splunk.com/answers/36774/distributed-search-knowledge-bundle-regex

View solution in original post

0 Karma

imrago
Contributor

I found the cause of the problem : a symbolic link in the /opt/splunk/etc/apps/applicationname/appserver/static folder. It was working in earlier versions (4.2.2) . Could it be a bug?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!