Splunk Enterprise

Different Time to Reap Knowledge Bundle Directory between search peers

francoisternois
Path Finder

Hi,

I have a difference between 2 search peers, both members of my indexer cluster, for the time to Reap Knowledge Bundle Directory. The average of the first one is about 2~3s whereas the second one is about 30s (or more). The hardware is the same, no huge difference in the network.

It seems that the first one receive most of the time delta bundle but the 2nd one mainly baseline. I think that why it take more time - the bundles are bigger.

It results that sometimes the searches are really slow or fail. Any idea to solve this?

Regards,

Francois

Labels (1)
Tags (2)
0 Karma
1 Solution

francoisternois
Path Finder

Hi,

This was due to hardware issue on the RAID group.

Regards,

Francois

View solution in original post

0 Karma

francoisternois
Path Finder

Hi,

This was due to hardware issue on the RAID group.

Regards,

Francois

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...