We are setting up our first dedicated search head. Need some info of the Knowledge bundle replication process.
1) what is the maxbundlesize units ? the default 2048 - is this kb, MB etc...
2) does this replication process copy all the files from the ../apps ../users ../system to the search peer ? So that if you update a app on the search head it will automatically updated it on the search peer ?
3) what log does this process write to?
4) Is there a way to manually run this process, like from the command line or will simply restarting the splunk service kick it off?
1. Yes maxBundleSize is in GB. The default value is 2GB.
2. Not all configuration files. Some configuration files (like authorize, props and transforms etc.) and assets like (csv/kvstore lookups etc) are copied to bundle. The search head replicates the knowledge bundle periodically in the background or when initiating a search.
3. metrics.log - indexed in _internal index.
index=_internal sourcetype=splunkd group=bundle*
4. No, The search head replicates the knowledge bundle periodically in the background or when initiating a search. You can run a search to replicate a newly cerated asset/config to search peers.