Splunk Search

Large Knowledge Bundle replication

pcsegal
Explorer

Hi,

Background: I have a standalone Splunk Enterprise environment. It has "Geospatial" lookup definitions pointing to KML lookup files, and many searches depend on these geospatial lookups. There are currently 24 such lookups (and the number can potentially grow) for several countries; that is, several hundred megabytes worth of lookup files. I need to migrate this to a clustered environment with one master, an indexer cluster (composed of 3 peers), and one search head.

I'm testing this in a development environment and am planning to move it to production, but I'm concerned about several details on how knowledge bundle replication works.

  1. Should I be concerned that I have a large set of geospatial lookup files?

  2. These geospatial lookup files will rarely, if ever, change. Only more may be added. Does this mean that their replication will only happen once they're added?

  3. I have read that you can blacklist lookup files from the knowledge bundle and use "local=true" in the searches, so that the lookups remain in the search head and are never replicated to the indexers. However, is it a good approach in terms of search performance?

Thank you in advance.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...