Hello everyone, i'm using splunk 6.2 and vmware 3.1
VMWare app comes with SA-VMW-HierarchyInventory, which produces a csv called TimeClusterServicesAvailability.csv.
This file is huge, around 800MB. Is there a reason for that? Is there something i can setup to reduce this filesize?
Why am i bothering :
i'm having a "Bundle replication fails" error. the splunkd.log says : replicating takes too long, and the bundle size is around 900MB.
I'm was trying to reduce the bundle size and searched for big file using :
find /opt/splunk/etc/ -type f -size +100000k -exec ls -lh {} \; | awk '{ print $9 ": " $5 }'
=>i found this file to be responsible.
Now i don't know how to fix this file...
Is there any Vmware app expert around?
Regards,
So without knowing the underpinnings of the VMware App csv lookups usage - you could "try" to blacklist that csv file from being replicated by putting it inside the distsearch.conf file under the [replicationBlacklist] section. I say "try" because I don't know for sure if that will break search on the indexers. Also not knowing the format per say, but you can also look inside the csv and prune out old data if it has existed for a long time.
So without knowing the underpinnings of the VMware App csv lookups usage - you could "try" to blacklist that csv file from being replicated by putting it inside the distsearch.conf file under the [replicationBlacklist] section. I say "try" because I don't know for sure if that will break search on the indexers. Also not knowing the format per say, but you can also look inside the csv and prune out old data if it has existed for a long time.
I forgot to mention : i did try to remove the search peer, reconfigure and reboot. I also iperf the network : 3.5Gb/s, no issue there.