Splunk Enterprise

knowledge bundle replication questions

cisaksen
Explorer

We are setting up our first dedicated search head.   Need some info of the Knowledge bundle replication process.

1) what is the maxbundlesize units ?   the default 2048  - is this kb, MB etc...

2) does this replication process copy all the files from the ../apps ../users ../system  to the search peer ?  So that if you update a app on the search head it will automatically updated it on the search peer ? 

3) what log does this process write to?

4) Is there a way to manually run this process, like from the command line or will simply restarting the splunk service kick it off?

Thanks

 

 

Labels (1)
0 Karma

manjunathmeti
Champion

hi @cisaksen,

1. Yes maxBundleSize is in GB. The default value is 2GB.

2. Not all configuration files. Some configuration files (like authorize, props and transforms etc.) and assets like (csv/kvstore lookups etc) are copied to bundle. The search head replicates the knowledge bundle periodically in the background or when initiating a search.

3. metrics.log - indexed in _internal index.

index=_internal sourcetype=splunkd group=bundle*

 

4. No, The search head replicates the knowledge bundle periodically in the background or when initiating a search. You can run a search to replicate a newly cerated asset/config to search peers.

 

Check this page for more info: https://docs.splunk.com/Documentation/Splunk/8.1.2/DistSearch/Knowledgebundlereplication

 

If this reply helps you, an upvote/like would be appreciated.

 

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!