I agree on that the docs could be clearer than this. There's a sort of implicit ttl on bundles which you can derive from settings in limits.conf: replication_period_sec = <int> * The minimum amount of time in seconds between two successive bundle replications. * Defaults to 60 replication_file_ttl = <int> * The TTL (in seconds) of bundle replication tarballs, i.e. *.bundle files. * Defaults to 600 (10m) sync_bundle_replication = [0|1|auto] * Flag indicating whether configuration file replication blocks searches or is run asynchronously * When setting this flag to auto Splunk will choose to use asynchronous replication iff all the peers * support async bundle replication, otherwise it will fallback into sync replication. * Defaults to auto Other than that, we're using plain old scripts using wget from a central http repository for some stuff in our environment. You could also use rsync, perhaps using lsync (http://ampledata.org/splunk_search_peer_synchronization_with_lsyncd.html ) but really the best option in my opinion would be to use the inbuilt bundle replication mechanisms unless you have good reasons not to use it. ... View more