Ask For Explanation - Search artifacts AND Knowledge bundle replic-

[AliMaher]

Hi,

I hope all is well. I want to ask for more information and simple explanation, as i came across the Distributed Search document and came out with two questions:

what is the search artifacts?

- it's the search result, and should be replicated but what is the content of that?

what is the the knowledge bundle?

- a set of configuration which directly transfer from the Search heads to the search peers, but why?

Thanks in advance!

[richgalloway · Accepted solution]

Search artifacts is the collection of data produced by a search.  It includes the results of the search plus the search log, telemetry, and more.  Artifacts should be replicated so they can be retrieved by other search heads in the cluster, for example if you are disconnected and reconnect to a different SH you still have access to the artifacts.

The knowledge bundle is the set of information indexers need to service a search query.  It includes .conf files, lookup files, external commands, and more.  The bundle supplies data needed for search-time operations that the indexer otherwise would not have (user KOs, for example).