Deployment Architecture

slow distributed search (DistributedBundleReplicationManager ?)

tawollen
Path Finder

We have 2 search heads, one is a lab box, so lower performance 4 way 8gig ram, but very few people use it. The other is a 16 way box. Our primary search head does no indexing locally at all, the lab box does some, (10,000 events/day). For some reason, the lab box seems REAL slow when doing searches, system load/memory is all good.

The only thing I have found in the logs is the following: From Lab box 12-01-2010 23:48:57.669 WARN DistributedBundleReplicationManager - bundle replication to 8 peer(s) took too long (227349ms), bundle file size=143900KB

From production: 12-01-2010 19:29:16.536 WARN DistributedBundleReplicationManager - bundle replication to 10 peer(s) took too long (10474ms), bundle file size=4130KB

I can't find any real reference to DistributedBundleReplicationManager in any documentation. The 'bundle replication" is taking a lot longer, and I am wondering if the "bundle file size" is making the one system slower than the other.

Any thoughts?

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

Do you have a very large lookup file or something inside one of the apps on your slow search head?

araitz
Splunk Employee
Splunk Employee

Does some content in your apps change a lot? Seems like a slow connection if it takes >10s to transfer <4 MB.

0 Karma

tawollen
Path Finder

We have some lookups, nothing that big, at least not in the app I am using, there might be something in one of the other apps.

0 Karma
Get Updates on the Splunk Community!

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? &#x1f680; We invite you to join our elite squad ...

Observability Cloud | AWS PrivateLink Enabled for Splunk Observability Cloud

We’ve enabled AWS PrivateLink for Observability Cloud, giving you an additional inbound connection to send ...

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...