# distsearch.conf

# Avoid the replication to the indexers of the KVstore backup tarball compressed files
[replicationDenylist]
trackme_backup_tgz = apps/trackme/backup/*.tgz
trackme_backup_dirs = apps/trackme/backup/...

# These lookups do not need to be replicated
trackme_cim_regex = apps/trackme/lookups/trackme_cim_regex.csv

# Machine Learning models: Anomaly detection will generate various ML models files, there are not needed on the indexer layers
trackme_mlmodels = apps/trackme/lookups/__mlspl_*.mlmodel

# From TrackMe version 2.0.84, ML models are owned in private mode by the splunk-system-user
trackme_mlmodels_private = users/splunk-system-user/trackme/lookups/__mlspl_*.mlmodel