Splunk Search

How to see search bundle or knowledge bundle activity on Splunk Search Head?

Splunk Employee
Splunk Employee

I am trying to figure out if the Splunk is sending Search Bundles very often and if these are full or delta?

Splunk Employee
Splunk Employee

Here are two easy ways to check it.

1)On the search head run the DEBUG command for DistributedBundleReplicationManager
./bin/splunk set log-level DistributedBundleReplicationManager -level DEBUG

once DEBUG is enabled you will see that splunkd.log has useful DEBUG information for component.

2) The other less invasive method to look the bundle activity will be to DistributedBundleReplicationManager

In some cases, it should be possible to confirm full bundle replication without enabling DEBUG, perhaps by:
 looking for POST to /services/receivers/bundle in splunkd_access.log from the indexers
 looking for metrics.log entries from the search head with group=bundles_uploads and baseline_count>0
 looking for metrics.log entries from the indexers with group=bundles_downloads and baseline_count>0

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!