Knowledge Management

Replication problem , how to see the contents of replication bundle ?


I created two collections in collection.conf of a app

Collections name r [ipaddress] [devices]

And it doesn’t have any other attributes
So what I got to know by default the “replicate=false”
So it is not replicated to indexers

Is there any way to make sure that the collections wil never replicate can we blacklist the collections (includ,exclud) in distsearch.conf of that particular app ?

Or is there any way to see
That these collections r replicated or not to indexers from looking into the bundle ?
Please help me

Tags (1)
0 Karma

Revered Legend

See this link for location of knowledge bundles on the search peer/indexers.

0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...