In a distributed search environment, can we blacklist the app in distsearch.conf and prevent it from being part of the bundle replication to search peers?
I have a search head cluster with the Machine Learning Toolkit and Python for Scientific Computing (for Linux 64-bit). I added the following to the blacklist stanza under distsearch.conf in the search heads - Will things still function if app is not replicated to search peers?
[replicationBlacklist]
ml_tool_kit = apps/Splunk_ML_Toolkit/...
scientific_python = apps/Splunk_SA_Scientific_Python_linux_x86_64/...
Does not look like you can. If you go into the app's search view, run a query e.g. index=_internal | head 1
Errors from indexers as shown:
12-07-2016 23:42:45.412 +0000 ERROR StreamedSearch - sid=remote_sh-abc-2.my.domain.com_1481154165.41768_6510209A-0131-4200-8B9D-63C774CA33FF, Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.