Splunk Search

Bundle Replication in Splunk

Arun_N_007
Communicator

What is Bundle Replication in Splunk? How it works in Search Head and Indexer?

In below link they explained about search flow in Splunk.

http://wiki.splunk.com/images/2/2a/Splunk_SearchFlow_v05_01.jpg

How to get the whole search transaction flow in _internal Index Using Splunk Query??

0 Karma
1 Solution

woodcock
Esteemed Legend

Bundle replication refers to the fact that Splunk will take the relevant knowledge objects (e.g. lookups, field extractsions, etc.) that exist on the Search Head where you are running your search and which apply to your search and "bundle" them up in order to distribute them to the search peers (Indexers) that will be running the map-reduced searches. In older versions of Splunk, the admin had to make sure that these knowledge objects had to be installed directly to each search peer and if this was not done correctly, the searches would not be run correctly and the search results would be wrong.

View solution in original post

woodcock
Esteemed Legend

Bundle replication refers to the fact that Splunk will take the relevant knowledge objects (e.g. lookups, field extractsions, etc.) that exist on the Search Head where you are running your search and which apply to your search and "bundle" them up in order to distribute them to the search peers (Indexers) that will be running the map-reduced searches. In older versions of Splunk, the admin had to make sure that these knowledge objects had to be installed directly to each search peer and if this was not done correctly, the searches would not be run correctly and the search results would be wrong.

Arun_N_007
Communicator

Thank you woodcock. Can you provide the link which explains better in Splunk docs???

0 Karma

woodcock
Esteemed Legend
0 Karma

emiller42
Motivator

I would recommend reading the following for instructions on how to set up distributed search:

http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Overviewofconfiguration

0 Karma
Get Updates on the Splunk Community!

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...