Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Blacklisting certain data from replicating in ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We are receiving replication failures several times a day between our searchhead and various indexers. From what I understand in distsearch.conf you can blacklist certain data from being replicated. Currently, we have over 100 jobs that run at various points throughout the night. Where can I start looking at within the jobs to see what I am able to blacklist? From what I understand, if a job only uses a specific indexer or search peer, we can tell that job to only replicate the searches needed to that specific search peer. Am I on track here? I am sure there is a lot of other data we can remove from the replication bundles as well.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What's in the bundle?
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Whatsearchheadssend
blacklisting / whitelisting files in the bundle
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Limittheknowledgebundlesize
Limiting the search peers (indexers) that your search runs on
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Distributedsearchgroups
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What's in the bundle?
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Whatsearchheadssend
blacklisting / whitelisting files in the bundle
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Limittheknowledgebundlesize
Limiting the search peers (indexers) that your search runs on
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Distributedsearchgroups
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am having the same issues in conjunction with Indexer timeouts. Does anyone have any input for this question? I'm extremely interested.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
