...ocs.splunk.com/Documentation/Splunk/8.2.0/Indexer/Multisitearchitecture 2. The other thing thats suggested to have knowledgebundle and search artifact replication is to have a SH c...
We are setting up our first dedicated search head. Need some info of the Knowledgebundlereplication process. 1) what is the maxbundlesize units ? the default 2048 - i...
Hello, I'm upgrading a search head from 7.3.0 to 8.2.1. First I upgraded it to 8.1.5 and I didn't experienced any problems. Then I upgraded to 8.2.1 and the knowledgebundlereplication to the search...
...everal details on how knowledgebundlereplication works.
Should I be concerned that I have a large set of geospatial lookup files?
These geospatial lookup files will rarely, if ever, change. O...
Hi All, I have this error message on the SH in Splunk: { Knowledgebundle size=3525MB exceeds max limit=2048MB. Distributed searches are running against an outdated knowledgebundle. Please r...
...onger than 10 seconds)". The knowledgebundle the Search head is currently replicating is about 250mb in size.
Doing a historical look back, I found that this error message was occurring approximately 5...
We are trying to test out the new "cascading" option for the knowledgebundlereplication policy. We have sat the replication policy on the search head to "cascading" in d...
Hi,
I'm looking for some answer and suggestion how I could decrease/workaround the knowledgebundlereplication errors we're seeing in our environment which is a multi site indexer clustering w...
...ead states "No knowledgebundlereplication cycle status is available yet." The search head that shows the error with the replication cycle status has no local knowledgebundle in /opt/splunk/var/r...
Due to some Performance Issues, Lookup/Dashboard failures, search failures and taking longtime to execute the searches. we have done some troubleshooting and come up with some exclusion list which n...