What search heads send to search peers

As part of the distributed search process, the search head replicates and distributes its knowledge objects to its search peers, or indexers. Knowledge objects include saved searches, event types, and other entities used in searching across indexes. The search head needs to distribute this material to its search peers so that they can properly execute queries on its behalf. This set of knowledge objects is called the knowledge bundle.

The search head replicates the knowledge bundle periodically in the background or when initiating a search.

For details on knowledge bundle replication, see the remaining topics in this chapter.