Splunk Search

Large Knowledge Bundle replication

pcsegal
Explorer

Hi,

Background: I have a standalone Splunk Enterprise environment. It has "Geospatial" lookup definitions pointing to KML lookup files, and many searches depend on these geospatial lookups. There are currently 24 such lookups (and the number can potentially grow) for several countries; that is, several hundred megabytes worth of lookup files. I need to migrate this to a clustered environment with one master, an indexer cluster (composed of 3 peers), and one search head.

I'm testing this in a development environment and am planning to move it to production, but I'm concerned about several details on how knowledge bundle replication works.

  1. Should I be concerned that I have a large set of geospatial lookup files?

  2. These geospatial lookup files will rarely, if ever, change. Only more may be added. Does this mean that their replication will only happen once they're added?

  3. I have read that you can blacklist lookup files from the knowledge bundle and use "local=true" in the searches, so that the lookups remain in the search head and are never replicated to the indexers. However, is it a good approach in terms of search performance?

Thank you in advance.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...