Hi,
Background: I have a standalone Splunk Enterprise environment. It has "Geospatial" lookup definitions pointing to KML lookup files, and many searches depend on these geospatial lookups. There are currently 24 such lookups (and the number can potentially grow) for several countries; that is, several hundred megabytes worth of lookup files. I need to migrate this to a clustered environment with one master, an indexer cluster (composed of 3 peers), and one search head.
I'm testing this in a development environment and am planning to move it to production, but I'm concerned about several details on how knowledge bundle replication works.
Should I be concerned that I have a large set of geospatial lookup files?
These geospatial lookup files will rarely, if ever, change. Only more may be added. Does this mean that their replication will only happen once they're added?
I have read that you can blacklist lookup files from the knowledge bundle and use "local=true" in the searches, so that the lookups remain in the search head and are never replicated to the indexers. However, is it a good approach in terms of search performance?
Thank you in advance.
