Replication Bundle

[sol69]

How do I fix replication bundle on Splunk Cloud SH?

[sol69]

The current bundle directory contains a large lookup file that might cause bundle replication fail. The path to the directory is /opt/splunk/var/run/sh-i-***********.splunlcloud.com-17*********.bundle. It's a cloud environment. Checked the HF and found nothing on the path to tar. There's seems nothing on the community for cloud environment. Found some solution for on prem. Thanks for your help

[richgalloway · Accepted solution]

You won't find search bundles on your HFs.  They're passed from SH to indexers.

Run this search to find out how big your lookup files are.  Make sure none are growing unexpectedly.  Trim the ones you can.  Consider adding the ones that don't need to be on the indexers to your deny list.

index=_audit host=sh* isdir=0 size lookups (action=update OR action=created OR action=modified OR action=add) NOT action=search
| stats latest(eval(size/1024/1024)) as size_mb latest(_time) as _time by path
| rex field=path "users\/(?<user>.*?)\/"
| rex field=path "\/apps\/(?<app>.*?)"
| fields _time path size_mb app file
| sort 0 - size_mb

[sol69]

Thanks for the search, is there an spl to trim or archive it?

[richgalloway]

Once you find the big lookup files, use admin commands/UI to delete them.  Or use the Lookup File Editor to modify them.  You also can upload an app containing a distsearch.conf file to put a file on the deny list.

[richgalloway]

It depends on what's wrong with it.  Tell us more or contact Splunk Support.