SmartStore system requirements

The requirements for SmartStore-enabled indexers are basically the same as for non-SmartStore-enabled indexers. The main differences are:

• Local storage requirements
• The need to connect to remote storage

Indexer requirements

Hardware requirements

Hardware requirements, with the exception of local storage (see below), are the same as for any Splunk Enterprise indexer. See:

• System requirements and other deployment considerations for indexer clusters in this manual
• Reference hardware in Capacity Planning Manual

SmartStore operations generally have no signifciant impact on CPU performance.

Local storage requirements

If you are running Splunk Enterprise on local Linux machines, the preferred local storage type is SSD.

If you are running Splunk Enterprise on AWS instances, use AWS with SSD (for example, AWS I3s, AWS R5s).

The amount of local storage available on each indexer for cached data must be in proportion to the expected working set. For best results, provision enough local storage to accommodate the equivalent of 30 days' worth of indexed data. For example, if the indexer is adding approximately 100GB/day of indexed data, the recommended size reserved for cached data is 3000GB. At a minimum, provision enough storage to keep at least 7-10 days of data in cache, as searches typically occur on data indexed within the last 7 - 10 days.

Note: The size of data indexed is typically around 50% of the size of data ingested, due to compression of data during indexing. However, there are a number of other factors that also enter into determining the size ratio of indexed data to ingested data. For a general discussion of Splunk Enterprise data volume and how to estimate your storage needs, refer to "Estimating your storage requirements" in the Installation Manual.

Other factors that enter into determining storage requirements include:

• The distribution of ingested data across the indexer cluster. Strive for balanced data ingestion across the indexers, so that all the indexers are indexing, and storing, approximately the same amount of data.
• The number of hot buckets on the indexers. Hot buckets follow replication and search factor policies, so they have, on a per bucket basis, larger storage requirements than warm buckets of the same size.

For purposes of configuring size, the cache is identical with the partition that the cache resides on. Typically, that partition also includes many other files, such as splunk binaries, the operating system, search artifacts, non-SmartStore indexes (if any), and so on. The index data itself resides in $SPLUNK_DB. For more information on cache sizing, see "Initiate eviction based on occupancy of the cache's disk partition".

Operating system requirements

Each on-prem machine must run the same Linux 3.x+ 64-bit operating system.

If, instead, you are running Splunk Enterprise on AWS instances, use AWS with SSD (for example, AWS I3s, AWS R5s).

Splunk Enterprise version requirements

All nodes (peer nodes, master node, and search heads) in the indexer cluster must be running Splunk Enterprise version 7.2 or later.

Additional version compatibility requirements apply to nodes in any indexer cluster, as described in Splunk Enterprise version compatibility.

Other indexer cluster requirements

All indexer cluster requirements apply to SmartStore indexes. For example:

• All index-related settings, including SmartStore-settings, must be configured identically across the peer nodes.
• You must enable SmartStore for the same set of indexes on all peer nodes.
• When you add a new index stanza, you must set repFactor to "auto".

For indexer cluster requirements in general, see System requirements and other deployment considerations for indexer clusters.

Network requirements

The indexers are clients of the remote store and use the standard https port to communicate with it.

Remote store requirements

See Configure the remote store for SmartStore.