Hi,
We have a distributed Splunk deployment with Index clustering. We observe that application bundles are present in /opt/splunk/var/run/splunk/cluster/remote-bundle location in the master indexer node. Upon examination we found that these are the bundles to be distributed to the slave indexers. But, we observe that multiple copies of the bundle with different time stamps are present in the folder. What is the use of these bundles? Is there any way to limit the size or the number of bundles that can be present? Please let us know.
Thanks,
Keerthana
↧