Deployment Architecture

which technology is being used for csv lookup replication (SH/indexer replication)

pargupta1234
New Member

I want to understand which technology is being used while CSV lookup bundle replication.
Is this whole CSV gets replicated or only changes in CSV get replicated?
I checked replication logs and found that not complete CSV gets replicated so why CSV lookup replication causes SH replication issue if the size of CSV exceeds 2 GB?
What is the problem with CSV lookup that it is not good for large lookup and everyone advice to move to KV store or DB connect?

Labels (2)
0 Karma

codebuilder
Influencer

The default limit for knowledge bundle replication is 2GB, it's not specific to lookups.
KV Store is generally recommended for lookups greater than 100MB because it is DB based (Mongo) and therefore much faster and more efficient.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...