Getting Data In

Blacklisting certain data from replicating in a bundle


We are receiving replication failures several times a day between our searchhead and various indexers. From what I understand in distsearch.conf you can blacklist certain data from being replicated. Currently, we have over 100 jobs that run at various points throughout the night. Where can I start looking at within the jobs to see what I am able to blacklist? From what I understand, if a job only uses a specific indexer or search peer, we can tell that job to only replicate the searches needed to that specific search peer. Am I on track here? I am sure there is a lot of other data we can remove from the replication bundles as well.

1 Solution

New Member

I am having the same issues in conjunction with Indexer timeouts. Does anyone have any input for this question? I'm extremely interested.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!