Splunk® Enterprise

Distributed Search

Classic knowledge bundle replication

In classic knowledge bundle replication, the search head sends the knowledge bundle directly to each of its search peers. As such, classic replication uses the simplest mechanism for replicating the knowledge bundle, and it is appropriate for relatively small deployments.

For deployments with larger numbers of search peers, exceeding 15 or 20, the classic policy is not optimal, as it can result in slow bundle replication. For larger deployments, it is usually better to employ the cascading policy.

Configure classic bundle replication

Classic bundle replication is the default method for replicating the knowledge bundle. If you need to revert to this policy from some other policy, edit the replicationPolicy setting in the [replicationSettings] stanza of distsearch.conf on the search head:

replicationPolicy = classic

You must restart the search head for the change to take effect.

The replicationThreads setting in distsearch.conf determines how many threads are available to the search head for sending bundles in parallel to search peers. Its default setting of "auto" usually provides the optimal thread allocation.

Last modified on 09 October, 2019
Modify the knowledge bundle   Cascading knowledge bundle replication

This documentation applies to the following versions of Splunk® Enterprise: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.2.0, 9.2.1

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters