Deployment Architecture

which technology is being used for csv lookup replication (SH/indexer replication)

pargupta1234
New Member

I want to understand which technology is being used while CSV lookup bundle replication.
Is this whole CSV gets replicated or only changes in CSV get replicated?
I checked replication logs and found that not complete CSV gets replicated so why CSV lookup replication causes SH replication issue if the size of CSV exceeds 2 GB?
What is the problem with CSV lookup that it is not good for large lookup and everyone advice to move to KV store or DB connect?

Labels (2)
0 Karma

codebuilder
Influencer

The default limit for knowledge bundle replication is 2GB, it's not specific to lookups.
KV Store is generally recommended for lookups greater than 100MB because it is DB based (Mongo) and therefore much faster and more efficient.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...