What search heads send to search peers
When initiating a distributed search, the search head replicates and distributes its knowledge objects to its search peers, or indexers. Knowledge objects include saved searches, event types, and other entities used in searching across indexes. The search head needs to distribute this material to its search peers so that they can properly execute queries on its behalf. This set of knowledge objects is called the knowledge bundle.
What the knowledge bundle contains
The search peers use the search head's knowledge bundle to execute queries on its behalf. When executing a distributed search, the peers are ignorant of any local knowledge objects. They have access only to the objects in the search head's knowledge bundle.
Bundles typically contain a subset of files (configuration files and assets) from
The process of distributing knowledge bundles means that peers by default receive nearly the entire contents of the search head's apps. If an app contains large binaries that do not need to be shared with the peers, you can eliminate them from the bundle and thus reduce the bundle size. See "Modify the knowledge bundle".
Location of the knowledge bundle
On the search head, the knowledge bundles resides under the
$SPLUNK_HOME/var/run directory. The bundles have the extension
.bundle for full bundles or
.delta for delta bundles. They are tar files, so you can run
tar tvf against them to see the contents.
The knowledge bundle gets distributed to the
$SPLUNK_HOME/var/run/searchpeers directory on each search peer. Because the knowledge bundle reside at a different location on the search peers than on the search head, search scripts should not hardcode paths to resources.
All authorization for a distributed search originates from the search head. At the time it sends the search request to its search peers, the search head also distributes the authorization information. It tells the search peers the name of the user running the search, the user's role, and the location of the distributed
authorize.conf file containing the authorization information.
About distributed search
Licenses for distributed search
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14