Search to verify bundle delivered

[rroberts]

Is there a search to check bundles delivered from search head to peers?

[rroberts · Accepted solution]

index=_audit action=replication

example event

1:06:22.126 PM Audit:[timestamp=03-23-2010 13:06:22.126, user=admin, action=replication, info=Bundle replication to peer named class4.splunk.com at https://class4.splunk.com:8089 succeeded.][n/a]

[ftk]

Consider adding some pretty formatting to the search string 🙂