Hi all,
We receive the warning : The current bundle directory contains a large lookup file that might cause bundle replication fail. The path to the directory is /opt/splunk/var/run/68DAE477-6A5A-40C6-A7CE-3778404DF158-1589383658-1589383891.delta
When looking into this .delta file it contains a few lookupfiles but they are only a few MB's. Also the full bundle files do not contain large lookups, we already blacklisted some large lookupfiles.
Something like this would work best:
index = _internal sourcetype = splunkd component=Archiver
Archiving large_file=*
| stats count latest(size_in_bytes) by large_file
Thanks so much. This worked for me. I removed that lookup file (~1GB), all good now.
If you're on a Unix platoform, here is the oneliner that I use:
tar tvf <bundlelocation/bundle.bundle> | awk -v size="$size" '$3 >= size {print $3" "$6}' | sort -t' ' -k1,1nr > /tmp/bundle.log; less /tmp/bundle.log
This is how I've troubleshoot bundle issues and to find out if there is something that I need to blacklist.
Thanks. I did exactly that check but there were no large files in the bundle. At this moment the messages disappeared. So I still dont know what caused the messages and what made them disappear.
Have a look at any other content in that delta file which might be bigger. If you can't see any big files in delta file then can you please let us know what is your .bundle
size and .delta
size ?
Thanks. At this moment the messages disappeared. So I still dont know what caused the messages and what made them disappear.