Bundle Replication in Splunk

[Arun_N_007]

What is Bundle Replication in Splunk? How it works in Search Head and Indexer?

In below link they explained about search flow in Splunk.

http://wiki.splunk.com/images/2/2a/Splunk_SearchFlow_v05_01.jpg

How to get the whole search transaction flow in _internal Index Using Splunk Query??

[woodcock · Accepted solution]

Bundle replication refers to the fact that Splunk will take the relevant knowledge objects (e.g. lookups, field extractsions, etc.) that exist on the Search Head where you are running your search and which apply to your search and "bundle" them up in order to distribute them to the search peers (Indexers) that will be running the map-reduced searches. In older versions of Splunk, the admin had to make sure that these knowledge objects had to be installed directly to each search peer and if this was not done correctly, the searches would not be run correctly and the search results would be wrong.

[Arun_N_007]

Thank you woodcock. Can you provide the link which explains better in Splunk docs???

[woodcock]

Read more here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/DistSearch/Whatsearchheadssend

[emiller42]

I would recommend reading the following for instructions on how to set up distributed search:

http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Overviewofconfiguration