What is Bundle Replication in Splunk? How it works in Search Head and Indexer?
In below link they explained about search flow in Splunk.
http://wiki.splunk.com/images/2/2a/Splunk_SearchFlow_v05_01.jpg
How to get the whole search transaction flow in _internal Index Using Splunk Query??
Bundle replication refers to the fact that Splunk will take the relevant knowledge objects
(e.g. lookups
, field extractsions
, etc.) that exist on the Search Head where you are running your search and which apply to your search and "bundle" them up in order to distribute them to the search peers (Indexers) that will be running the map-reduced searches. In older versions of Splunk, the admin had to make sure that these knowledge objects
had to be installed directly to each search peer and if this was not done correctly, the searches would not be run correctly and the search results would be wrong.
Bundle replication refers to the fact that Splunk will take the relevant knowledge objects
(e.g. lookups
, field extractsions
, etc.) that exist on the Search Head where you are running your search and which apply to your search and "bundle" them up in order to distribute them to the search peers (Indexers) that will be running the map-reduced searches. In older versions of Splunk, the admin had to make sure that these knowledge objects
had to be installed directly to each search peer and if this was not done correctly, the searches would not be run correctly and the search results would be wrong.
Thank you woodcock. Can you provide the link which explains better in Splunk docs???
I would recommend reading the following for instructions on how to set up distributed search:
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Overviewofconfiguration