I keep getting a message that the current bundle directory contains a large lookup file and the specified file is a delta under /opt/splunk/var/run. I read that the max_memtable_bytes determines the maximum size of lookups. But how about the delta? What delta size is too large? Or should I rather be looking at the largest lookups in the bundle to resolve the problem? Do you have any tipps on how to resolve this?Thanks.
my problem is rather that the delta is shown in the message, not the bundle. So my question is - should I look for a big file in the delta and what is considered a bid file for the delta? Or should I still look for big files in the bundle? I can't identify which file is causing the problem.
even the SH normally sends only delta there will be a situations when it needs to send the whole lookup. If it cannot sent even delta how it can send the whole lookup? Or if the delta is actually the whole lookup? For that reason I’m totally agree with @gcusello what is the best way to go forward.
in the message you should have the indication of the too large bundle, anyway, you could see in the Search Head Captain, the dimension of each app and find the too large bundle.
only the delta is mentioned in the message. That's why I am bit confused - should I be looking at the bundle instead? The delta is just the new changes made, while the bundle contains all lookups, as far as I know.
