I assume this is all still relevant as I have had the problem in 7.1.1. Just wanted to note that "noBinDir = .../bin/* " only took care of the bin files in $SPLUNK_HOME/etc/system for me, but if I changed it to ../bin/... it then worked anywhere. This is similar for the jar and lookups example he gave as I didn't get that to work. I am using "noBinOrJars = .../(bin|jars)/..." which works nicely. Another option for lookups is under the stanza [replicationSettings] using the setting "excludeReplicatedLookupSize = 1" as I was missing some lookups that cause search warnings because it could not find the lookup. If you do turn off the lookups folder entirely, you can turn off those errors for lookups by going to the individual transforms.conf stanza for the lookup and add "replicate=false". I also notice there is a "maxBundleSize" option (that defaults at 2048--2GB) if you have to increase it (maybe just temporarily while you work around the problem) but probably not a great idea to use.
... View more