How to see search bundle or knowledge bundle activity on Splunk Search Head?

[rbal_splunk]

I am trying to figure out if the Splunk is sending Search Bundles very often and if these are full or delta?

[rbal_splunk]

Here are two easy ways to check it.

1)On the search head run the DEBUG command for DistributedBundleReplicationManager
./bin/splunk set log-level DistributedBundleReplicationManager -level DEBUG

once DEBUG is enabled you will see that splunkd.log has useful DEBUG information for component.

2) The other less invasive method to look the bundle activity will be to DistributedBundleReplicationManager

In some cases, it should be possible to confirm full bundle replication without enabling DEBUG, perhaps by:
 looking for POST to /services/receivers/bundle in splunkd_access.log from the indexers
 looking for metrics.log entries from the search head with group=bundles_uploads and baseline_count>0
 looking for metrics.log entries from the indexers with group=bundles_downloads and baseline_count>0