Splunk Search

Large Knowledge Bundle replication



Background: I have a standalone Splunk Enterprise environment. It has "Geospatial" lookup definitions pointing to KML lookup files, and many searches depend on these geospatial lookups. There are currently 24 such lookups (and the number can potentially grow) for several countries; that is, several hundred megabytes worth of lookup files. I need to migrate this to a clustered environment with one master, an indexer cluster (composed of 3 peers), and one search head.

I'm testing this in a development environment and am planning to move it to production, but I'm concerned about several details on how knowledge bundle replication works.

  1. Should I be concerned that I have a large set of geospatial lookup files?

  2. These geospatial lookup files will rarely, if ever, change. Only more may be added. Does this mean that their replication will only happen once they're added?

  3. I have read that you can blacklist lookup files from the knowledge bundle and use "local=true" in the searches, so that the lookups remain in the search head and are never replicated to the indexers. However, is it a good approach in terms of search performance?

Thank you in advance.

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...