Splunk Enterprise

Different Time to Reap Knowledge Bundle Directory between search peers

francoisternois
Path Finder

Hi,

I have a difference between 2 search peers, both members of my indexer cluster, for the time to Reap Knowledge Bundle Directory. The average of the first one is about 2~3s whereas the second one is about 30s (or more). The hardware is the same, no huge difference in the network.

It seems that the first one receive most of the time delta bundle but the 2nd one mainly baseline. I think that why it take more time - the bundles are bigger.

It results that sometimes the searches are really slow or fail. Any idea to solve this?

Regards,

Francois

Labels (1)
Tags (2)
0 Karma
1 Solution

francoisternois
Path Finder

Hi,

This was due to hardware issue on the RAID group.

Regards,

Francois

View solution in original post

0 Karma

francoisternois
Path Finder

Hi,

This was due to hardware issue on the RAID group.

Regards,

Francois

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...