Splunk Search

Bundle Replication in Splunk

Communicator

What is Bundle Replication in Splunk? How it works in Search Head and Indexer?

In below link they explained about search flow in Splunk.

http://wiki.splunk.com/images/2/2a/Splunk_SearchFlow_v05_01.jpg

How to get the whole search transaction flow in _internal Index Using Splunk Query??

0 Karma
1 Solution

Esteemed Legend

Bundle replication refers to the fact that Splunk will take the relevant knowledge objects (e.g. lookups, field extractsions, etc.) that exist on the Search Head where you are running your search and which apply to your search and "bundle" them up in order to distribute them to the search peers (Indexers) that will be running the map-reduced searches. In older versions of Splunk, the admin had to make sure that these knowledge objects had to be installed directly to each search peer and if this was not done correctly, the searches would not be run correctly and the search results would be wrong.

View solution in original post

Esteemed Legend

Bundle replication refers to the fact that Splunk will take the relevant knowledge objects (e.g. lookups, field extractsions, etc.) that exist on the Search Head where you are running your search and which apply to your search and "bundle" them up in order to distribute them to the search peers (Indexers) that will be running the map-reduced searches. In older versions of Splunk, the admin had to make sure that these knowledge objects had to be installed directly to each search peer and if this was not done correctly, the searches would not be run correctly and the search results would be wrong.

View solution in original post

Communicator

Thank you woodcock. Can you provide the link which explains better in Splunk docs???

0 Karma

Esteemed Legend
0 Karma

Motivator

I would recommend reading the following for instructions on how to set up distributed search:

http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Overviewofconfiguration

0 Karma