Deployment Architecture

distsearch.conf can you link replicationBlacklist and dmc_group (peer groups)

jonxilinx
Path Finder

in the distsearch.conf on our search head we can blacklist applications

 

[replicationBlacklist]
splunk_app1_blacklist = apps/splunk_app1/...

splunk_app2_blacklist = apps/splunk_app2/...

We can also define groups of search peers (here we have peers in two groups)

[distributedSearch:dmc_group_main]
servers = 172.21.72.127:8089,172.21.72.128:8089
default = true

[distributedSearch:dmc_group_satelite]
servers = 10.1.1.1:8089,10.1.1.2:8089
default = true

 

If we dont have indexes for app1 and app2 on peers dmc_group_satelite,

can the [replicationBlacklist] be written in a way  so that its not pushing the peerbundles to it

ONLY want  to push bundles to group_main

(no need to have a knowledge bundle on peers that dont have searchable index)

Many thanks, Jon

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...