Deployment Architecture

slow distributed search (DistributedBundleReplicationManager ?)

tawollen
Path Finder

We have 2 search heads, one is a lab box, so lower performance 4 way 8gig ram, but very few people use it. The other is a 16 way box. Our primary search head does no indexing locally at all, the lab box does some, (10,000 events/day). For some reason, the lab box seems REAL slow when doing searches, system load/memory is all good.

The only thing I have found in the logs is the following: From Lab box 12-01-2010 23:48:57.669 WARN DistributedBundleReplicationManager - bundle replication to 8 peer(s) took too long (227349ms), bundle file size=143900KB

From production: 12-01-2010 19:29:16.536 WARN DistributedBundleReplicationManager - bundle replication to 10 peer(s) took too long (10474ms), bundle file size=4130KB

I can't find any real reference to DistributedBundleReplicationManager in any documentation. The 'bundle replication" is taking a lot longer, and I am wondering if the "bundle file size" is making the one system slower than the other.

Any thoughts?

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

Do you have a very large lookup file or something inside one of the apps on your slow search head?

araitz
Splunk Employee
Splunk Employee

Does some content in your apps change a lot? Seems like a slow connection if it takes >10s to transfer <4 MB.

0 Karma

tawollen
Path Finder

We have some lookups, nothing that big, at least not in the app I am using, there might be something in one of the other apps.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...