I just fixed our issue. Ours was related to a knowledge bundle that would not get pushed to the SHC machines. The App would get the GUI, but search would not work because the knowledge bundle was not replicating. I found the large lookup files within another App. The knowledge bundle had grown to 15GB  and 3GB was the limit.  I could have possibly increased the limit, but instead I just deleted 12 GB worth of files from the bundle and re-pushed the app. The problem is now resolved. I searched for the large files by navigating to /opt/splunk/etc/apps and running: find . -size +1G -name *.csv  then I backed up the large files to the /tmp directory. then I deleted the lookup files from the GUI. (I deleted them from the GUI so the deletions would replicate across the cluster) ... View more