Deployment Architecture

which technology is being used for csv lookup replication (SH/indexer replication)

pargupta1234
New Member

I want to understand which technology is being used while CSV lookup bundle replication.
Is this whole CSV gets replicated or only changes in CSV get replicated?
I checked replication logs and found that not complete CSV gets replicated so why CSV lookup replication causes SH replication issue if the size of CSV exceeds 2 GB?
What is the problem with CSV lookup that it is not good for large lookup and everyone advice to move to KV store or DB connect?

Labels (2)
0 Karma

codebuilder
Influencer

The default limit for knowledge bundle replication is 2GB, it's not specific to lookups.
KV Store is generally recommended for lookups greater than 100MB because it is DB based (Mongo) and therefore much faster and more efficient.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...