Classic knowledge bundle replication
In classic knowledge bundle replication, the search head sends the knowledge bundle directly to each of its search peers. As such, classic replication uses the simplest mechanism for replicating the knowledge bundle, and it is appropriate for relatively small deployments.
For deployments with larger numbers of search peers, exceeding 15 or 20, the classic policy is not optimal, as it can result in slow bundle replication. For larger deployments, it is usually better to employ the cascading policy.
Configure classic bundle replication
Classic bundle replication is the default method for replicating the knowledge bundle. If you need to revert to this policy from some other policy, edit the replicationPolicy
setting in the [replicationSettings]
stanza of distsearch.conf
on the search head:
[replicationSettings] replicationPolicy = classic
You must restart the search head for the change to take effect.
The replicationThreads
setting in distsearch.conf
determines how many threads are available to the search head for sending bundles in parallel to search peers. Its default setting of "auto" usually provides the optimal thread allocation.
Modify the knowledge bundle | Cascading knowledge bundle replication |
This documentation applies to the following versions of Splunk® Enterprise: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1
Feedback submitted, thanks!