Deployment Architecture

because of a symlink size of bundle file is 0 on searchhead in /opt/splunk/var/run/

imrago
Contributor

Hi,

I have a simple setup, one searchhead and one indexer. Starting from the latest upgrade to 4.2.4 the size of bundle file on the searchhead is always zero and it is not being replicated to the indexer.
How could I fix this or how could I find the cause of the problem?

Tags (2)
0 Karma
1 Solution

imrago
Contributor

I solved the problem by creating a blacklist for the directory containing the symlink, the following post helped me a lot:

http://splunk-base.splunk.com/answers/36774/distributed-search-knowledge-bundle-regex

View solution in original post

0 Karma

imrago
Contributor

I solved the problem by creating a blacklist for the directory containing the symlink, the following post helped me a lot:

http://splunk-base.splunk.com/answers/36774/distributed-search-knowledge-bundle-regex

0 Karma

imrago
Contributor

I found the cause of the problem : a symbolic link in the /opt/splunk/etc/apps/applicationname/appserver/static folder. It was working in earlier versions (4.2.2) . Could it be a bug?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...