Splunk Enterprise

knowledge bundle replication questions

cisaksen
Explorer

We are setting up our first dedicated search head.   Need some info of the Knowledge bundle replication process.

1) what is the maxbundlesize units ?   the default 2048  - is this kb, MB etc...

2) does this replication process copy all the files from the ../apps ../users ../system  to the search peer ?  So that if you update a app on the search head it will automatically updated it on the search peer ? 

3) what log does this process write to?

4) Is there a way to manually run this process, like from the command line or will simply restarting the splunk service kick it off?

Thanks

 

 

Labels (1)
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @cisaksen,

1. Yes maxBundleSize is in GB. The default value is 2GB.

2. Not all configuration files. Some configuration files (like authorize, props and transforms etc.) and assets like (csv/kvstore lookups etc) are copied to bundle. The search head replicates the knowledge bundle periodically in the background or when initiating a search.

3. metrics.log - indexed in _internal index.

index=_internal sourcetype=splunkd group=bundle*

 

4. No, The search head replicates the knowledge bundle periodically in the background or when initiating a search. You can run a search to replicate a newly cerated asset/config to search peers.

 

Check this page for more info: https://docs.splunk.com/Documentation/Splunk/8.1.2/DistSearch/Knowledgebundlereplication

 

If this reply helps you, an upvote/like would be appreciated.

 

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...