Hi All,  I have an Warning message on my search head GUI as below: "The current bundle directory contains a large lookup file that might cause bundle replication fail. The path to the directory is /opt/splunk/var/run/hostename-randomnumber-randomnumber.delta" When i validated respective delta file, it's not even one MB. Still getting this Warning message frequently. Could anyone please help ? i see same messages on splunkd.log too. -rw------- 1 root root 188M Apr 2 10:36 hostname-1617352591.bundle -rw------- 1 root root 80K Apr 2 10:36 hostname-1617352525-1617352591.delta ... View more

Hello All,   We have 20 indexers and 5 HF's in our Environment. HF's are forwarding their data to indexers. I'd need to find out,  which servers are sending logs to HF's. is there any SPL query i can use for same ? Thanks ... View more

Hi, We have a search head cluster of 8 members in which KV store is failing frequently. We used to start services manually. I'd like to create a report which should contains when exactly  kv store got failed & when it got up. I am not sure in which logs we can find this info.  Could anyone help me with the query for same ? Thanks   ... View more