Deployment Architecture

Search Head Cluster: "WARN...single_action=PUSH_TO took wallclock_ms=1553! Consider a lower value of conf_replication_max_push_count in server.conf on all members"

sat94541
Communicator

We have three Node Search Head Cluster member and we are seeing the following messages in our splunkd.log:

12-08-2015 10:00:25.468 -0800 WARN  ConfMetrics - single_action=PUSH_TO took wallclock_ms=1553! Consider a lower value of conf_replication_max_push_count in server.conf on all members
12-08-2015 10:00:25.468 -0800 WARN  ConfMetrics - single_action=PUSH_TO took wallclock_ms=1553! Consider a lower value of conf_replication_max_push_count in server.conf on all members

What does this error message mean?

0 Karma
1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

Here is some information on this error message

in summary, Configuration replication within the SHC is slower than the ideal standards (of 1 second), possibly because the SHC needs to frequently replicate the config updates with large lookup files.

We currently don't support blacklisting of the lookup files in the SHC.If you want to confirm this, on each of the Search Heads, please take a backup of the latest bundle file under var/run/splunk/snapshot to a temporary directory, and make a note of their sizes. untar the bundle file (tar xvf ...) and make a note of the largest files in the bundle directory. The expectation is the largest files in the bundle would be the lookup csv files, which will confirm this.

View solution in original post

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Here is some information on this error message

in summary, Configuration replication within the SHC is slower than the ideal standards (of 1 second), possibly because the SHC needs to frequently replicate the config updates with large lookup files.

We currently don't support blacklisting of the lookup files in the SHC.If you want to confirm this, on each of the Search Heads, please take a backup of the latest bundle file under var/run/splunk/snapshot to a temporary directory, and make a note of their sizes. untar the bundle file (tar xvf ...) and make a note of the largest files in the bundle directory. The expectation is the largest files in the bundle would be the lookup csv files, which will confirm this.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...