Distributed Search Knowledge Bundle Regex

[Splunker]

Folks,

I have a Splunk 4.2.4 search-head and indexer on another machine in a distributed setup.

I'm getting an error in my splunkd.log about my knowledge bundle timing out replicating from search-head to indexer.

I've tried the following in my distsearch.conf:

[replicationWhitelist]
allConf = *.conf
allSpec = *.spec

Based on the Splunk docs. Looking in $SPLUNK_HOME/var/run/searchpeers/(latest).bundle on the indexer i see all sorts of files in the tarball not just the ones i've allowed via my whitelist.

I've restarted both search-head & indexer and am not sure what to try next? Do i also need a global blacklist?

Thanks.

[Splunker · Accepted solution]

I managed to fix the above problem after realising the regex's need the full path to the offending large files.

*.conf seems to only match in the root-level directories ($SPLUNK_HOME/etc /users /etc/apps, etc..)

Something like (i had a large lookup list in my Google Maps and MAXMIND app (the geoip DB)):

[replicationBlacklist]
AppMapsCSV = maps/local/*.csv
AppMaxMindCSV = MAXMIND/local/*.csv

Did the trick, which significantly dropped my knowledge bundle size to something more manageable.

Hope it helps someone 🙂