All Apps and Add-ons

TimeClusterServicesAvailability.csv is huge in Vmware app

sd100
Explorer

Hello everyone, i'm using splunk 6.2 and vmware 3.1
VMWare app comes with SA-VMW-HierarchyInventory, which produces a csv called TimeClusterServicesAvailability.csv.
This file is huge, around 800MB. Is there a reason for that? Is there something i can setup to reduce this filesize?

Why am i bothering :
i'm having a "Bundle replication fails" error. the splunkd.log says : replicating takes too long, and the bundle size is around 900MB.
I'm was trying to reduce the bundle size and searched for big file using :
find /opt/splunk/etc/ -type f -size +100000k -exec ls -lh {} \; | awk '{ print $9 ": " $5 }'
=>i found this file to be responsible.

Now i don't know how to fix this file...
Is there any Vmware app expert around?
Regards,

1 Solution

mgildenhorn_spl
Splunk Employee
Splunk Employee

So without knowing the underpinnings of the VMware App csv lookups usage - you could "try" to blacklist that csv file from being replicated by putting it inside the distsearch.conf file under the [replicationBlacklist] section. I say "try" because I don't know for sure if that will break search on the indexers. Also not knowing the format per say, but you can also look inside the csv and prune out old data if it has existed for a long time.

View solution in original post

0 Karma

mgildenhorn_spl
Splunk Employee
Splunk Employee

So without knowing the underpinnings of the VMware App csv lookups usage - you could "try" to blacklist that csv file from being replicated by putting it inside the distsearch.conf file under the [replicationBlacklist] section. I say "try" because I don't know for sure if that will break search on the indexers. Also not knowing the format per say, but you can also look inside the csv and prune out old data if it has existed for a long time.

0 Karma

sd100
Explorer

I forgot to mention : i did try to remove the search peer, reconfigure and reboot. I also iperf the network : 3.5Gb/s, no issue there.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...