bundle replication taking too long

[EricPartington]

I have messages like the one below on a regular basis on my deployment server. Is there any way to determine what bundle is taking too long to replicate? Are there any other searches that will help me to determine which bundle to investigate?

10-05-2011 08:32:26.359 -0400 WARN DistributedBundleReplicationManager - bundle replication to 5 peer(s) took too long (18482ms), bundle file size=29110KB, replication_id=1317817927

[gkanapathy · Accepted solution]

Well, as of 4.1 and 4.2, there's only one bundle, and it's basically the entire contents of etc/apps, etc/system, and etc/users (with a limited set of exceptions). So pretty much, if you have something large anywhere in those locations (and I suspect it's a large lookup file) that's the cause.

To deal with this, you can either use network-mounted bundles (and disable replication), or see if asynchronous replication works for you. Both of these config options are available in 4.2 and up.

[dstaulcu]

noticed that splunk app for windows had one such very large lookup files