Deployment Architecture
Highlighted

bundle replication taking too long

Communicator

I have messages like the one below on a regular basis on my deployment server. Is there any way to determine what bundle is taking too long to replicate? Are there any other searches that will help me to determine which bundle to investigate?

10-05-2011 08:32:26.359 -0400 WARN DistributedBundleReplicationManager - bundle replication to 5 peer(s) took too long (18482ms), bundle file size=29110KB, replication_id=1317817927

Highlighted

Re: bundle replication taking too long

Splunk Employee
Splunk Employee

Well, as of 4.1 and 4.2, there's only one bundle, and it's basically the entire contents of etc/apps, etc/system, and etc/users (with a limited set of exceptions). So pretty much, if you have something large anywhere in those locations (and I suspect it's a large lookup file) that's the cause.

To deal with this, you can either use network-mounted bundles (and disable replication), or see if asynchronous replication works for you. Both of these config options are available in 4.2 and up.

View solution in original post

Highlighted

Re: bundle replication taking too long

Builder

noticed that splunk app for windows had one such very large lookup files

0 Karma