Splunk says bundle directory contains a large lookup file in .delta file but the .delta file does not contain a large lookup

[fboeje]

Hi all,

We receive the warning : The current bundle directory contains a large lookup file that might cause bundle replication fail. The path to the directory is /opt/splunk/var/run/68DAE477-6A5A-40C6-A7CE-3778404DF158-1589383658-1589383891.delta
When looking into this .delta file it contains a few lookupfiles but they are only a few MB's. Also the full bundle files do not contain large lookups, we already blacklisted some large lookupfiles.

[_joe]

Something like this would work best:

index = _internal sourcetype = splunkd component=Archiver
Archiving large_file=*
| stats count latest(size_in_bytes) by large_file

[Huu-Nguyen]

Thanks so much. This worked for me. I removed that lookup file (~1GB), all good now.

[ragedsparrow]

If you're on a Unix platoform, here is the oneliner that I use:

tar tvf <bundlelocation/bundle.bundle> | awk -v size="$size" '$3 >= size {print $3" "$6}'   | sort -t' ' -k1,1nr > /tmp/bundle.log; less /tmp/bundle.log

This is how I've troubleshoot bundle issues and to find out if there is something that I need to blacklist.

[fboeje]

Thanks. I did exactly that check but there were no large files in the bundle. At this moment the messages disappeared. So I still dont know what caused the messages and what made them disappear.

[harsmarvania57]

Have a look at any other content in that delta file which might be bigger. If you can't see any big files in delta file then can you please let us know what is your .bundle size and .delta size ?

[fboeje]

Thanks. At this moment the messages disappeared. So I still dont know what caused the messages and what made them disappear.