In Splunk Enterprise , when knowledge bundles (which include lookup files, configurations, and other knowledge objects) are replicated between search heads and indexers, administrators can control the maximum size of lookup files that are eligible for replication.
The correct parameter to use is excludeReplicatedLookupSize , defined in distsearch.conf . This parameter specifies a maximum file size (in megabytes) beyond which lookup files are excluded from bundle replication . By setting this to 500, any lookup file larger than 500 MB will not be replicated to search peers.
This is especially important for performance optimization and preventing unnecessary network load during search head to indexer communication.
Example configuration (distsearch.conf):
[replicationSettings]
excludeReplicatedLookupSize = 500
Reference (Splunk Documentation):
distsearch.conf.spec and example → excludeReplicatedLookupSize
Splunk® Enterprise Distributed Search Manual → “Control knowledge bundle replication between search heads and indexers”
Splunk Admin Manual → “Prevent large lookup files from being replicated”
