- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
knowledge bundle replication questions
We are setting up our first dedicated search head. Need some info of the Knowledge bundle replication process.
1) what is the maxbundlesize units ? the default 2048 - is this kb, MB etc...
2) does this replication process copy all the files from the ../apps ../users ../system to the search peer ? So that if you update a app on the search head it will automatically updated it on the search peer ?
3) what log does this process write to?
4) Is there a way to manually run this process, like from the command line or will simply restarting the splunk service kick it off?
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

hi @cisaksen,
1. Yes maxBundleSize is in GB. The default value is 2GB.
2. Not all configuration files. Some configuration files (like authorize, props and transforms etc.) and assets like (csv/kvstore lookups etc) are copied to bundle. The search head replicates the knowledge bundle periodically in the background or when initiating a search.
3. metrics.log - indexed in _internal index.
index=_internal sourcetype=splunkd group=bundle*
4. No, The search head replicates the knowledge bundle periodically in the background or when initiating a search. You can run a search to replicate a newly cerated asset/config to search peers.
Check this page for more info: https://docs.splunk.com/Documentation/Splunk/8.1.2/DistSearch/Knowledgebundlereplication
If this reply helps you, an upvote/like would be appreciated.
