Splunk Dev

DistributedBundleReplicationManager - bundle replication to 1 peer(s) took too lon

drussell88
Explorer

I am receiving the following error message in my splunkd log. DistributedBundleReplicationManager - bundle replication to 1 peer(s) took too long. Do you know what is causing it and how I can fix it?

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

This is caused by stuff being replicated from the SH to the indexer. AFAIK, this is most often just a warning that it took long time, not TOO long time. So normally your bundle got replicated, but it took more than X seconds.

Quite likely you have some large piece of data in one of your apps (MAXMIND is one I've come across that contains a lot of data).

http://splunk-base.splunk.com/answers/31724/bundle-replication-taking-too-long
http://splunk-base.splunk.com/answers/68488/what-does-this-event-mean-warn-distributedbundlereplicat...

BR,

Kristian

drussell88
Explorer

Thank you for your reply. Could this cause lag time in my saved searches? What is the best way to find these large pieces of data in my apps?

0 Karma

drussell88
Explorer

I also need to mention that I only have one search head, one indexer and 39 universal forwarders. I am not sure why this is warnining for distributed bundle replication.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...