Classic knowledge bundle replication
In classic knowledge bundle replication, the search head sends the knowledge bundle directly to each of its search peers. As such, classic replication uses the simplest mechanism for replicating the knowledge bundle, and it is appropriate for relatively small deployments.
For deployments with larger numbers of search peers, exceeding 15 or 20, the classic policy is not optimal, as it can result in slow bundle replication. For larger deployments, it is usually better to employ the cascading policy.
Configure classic bundle replication
Classic bundle replication is the default method for replicating the knowledge bundle. If you need to revert to this policy from some other policy, edit the
replicationPolicy setting in the
[replicationSettings] stanza of
distsearch.conf on the search head:
[replicationSettings] replicationPolicy = classic
You must restart the search head for the change to take effect.
replicationThreads setting in
distsearch.conf determines how many threads are available to the search head for sending bundles in parallel to search peers. Its default setting of "auto" usually provides the optimal thread allocation.
Modify the knowledge bundle
Cascading knowledge bundle replication
This documentation applies to the following versions of Splunk® Enterprise: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4
Feedback submitted, thanks!