Configure SmartStore
SmartStore configuration settings reside in three files:
SmartStore settings in indexes.conf
The SmartStore settings in indexes.conf
enable and control SmartStore indexes.
You can enable SmartStore for all of an indexer's indexes, or you can enable SmartStore on an index-by-index basis, allowing a mix of SmartStore and non-SmartStore indexes on the same indexer.
When you configure these settings on an indexer cluster's peer nodes, you must deploy the settings through the configuration bundle method. As with all settings in indexes.conf
, SmartStore settings must be the same across all peer nodes.
The table lists the main SmartStore-related settings in indexes.conf
.
SmartStore indexes.conf setting | Stanza level | Description |
---|---|---|
remotePath = <root path for remote volume>
|
index or global | Enables SmartStore and sets the remote path for the index's volume. See Deploy SmartStore on a new indexer cluster. |
storageType = remote
|
volume | Sets the volume's storage type to remote. See Deploy SmartStore on a new indexer cluster. |
path = <scheme>://<remote-location-specifier>
|
volume | Sets the remote storage location where indexes reside. See Deploy SmartStore on a new indexer cluster.
|
maxGlobalDataSizeMB = <integer>
|
index or global | Determines bucket freezing behavior. Sets the maximum amount of space that the warm buckets of a SmartStore index can occupy. When this maximum is exceeded, the oldest bucket gets frozen. See Configure data retention for SmartStore indexes. |
hotlist_recency_secs = <integer>
|
index | Specifies the time period, based on the bucket's age, that the cache manager attempts to protect a recent bucket from eviction. This setting operates on a per-index level, while the version of the setting in server.conf operates across all indexes. See Configure the SmartStore cache manager.
|
hotlist_bloom_filter_recency_hours = <integer>
|
index | Specifies the time period, based on the bucket's age, that the cache manager attempts to protect the bucket's non-journal and non-tsidx files, such as the bloomfilter file, from eviction. This setting operates on a per-index level, while the version of the setting in server.conf operates across all indexes. See Configure the SmartStore cache manager.
|
In indexes.conf
, you can also configure various settings specific to your remote storage type. For example, there are a number of settings that begin with remote.s3
. These settings are specific to S3, such as remote.s3.access_key
and remote.s3.secret_key
. You configure these settings in the stanza where you configure the remote volume.
When specifying a setting that begins with remote.s3
, you must use a lowercase "s" in "s3". Uppercase "S", such as remote.S3
... is not a valid substitute and causes any attempted update to the setting's value to not take effect.
For details on these and other indexes.conf
settings, see indexes.conf.spec. .
Non-SmartStore-specific settings in indexes.conf
You must specify these configurations for all SmartStore indexes:
repfactor = auto
, with indexer clustersmaxDataSize = auto
(the default value, which is 750MB)coldPath
requires a path value, even though the setting is ignored except in the case of migrated indexes.
SmartStore settings in server.conf
The SmartStore-related settings in server.conf
control the behavior of indexers, including the functionality of the cache manager. The table lists the most frequently configured settings.
SmartStore server.conf setting | Stanza level | Description |
---|---|---|
eviction_policy = <string>
|
[cachemanager]
|
Sets the policy that determines which buckets the cache manager evicts next. Defaults to "lru". See Configure the SmartStore cache manager. |
max_cache_size = <integer>
|
[cachemanager]
|
Specifies the maximum space, in megabytes, that the cache can occupy on a disk partition. See Configure the SmartStore cache manager. |
eviction_padding = <integer>
|
[cachemanager]
|
Specifies the additional space, in megabytes, beyond minFreeSpace that the cache manager uses as the threshold to start evicting data. See Configure the SmartStore cache manager.
|
hotlist_recency_secs = <integer>
|
[cachemanager]
|
Specifies the time period, based on the bucket's age, that the cache manager attempts to protect a recent bucket from eviction. This setting operates on a global level, across all indexes, while the version of the setting in indexes.conf operates on a per-index level. See Configure the SmartStore cache manager.
|
hotlist_bloom_filter_recency_hours = <integer>
|
[cachemanager]
|
Specifies the time period, based on the bucket's age, that the cache manager attempts to protect the bucket's non-journal and non-tsidx files, such as the bloomfilter file, from eviction. This setting operates on a global level, across all indexes, while the version of the setting in indexes.conf operates on a per-index level. See Configure the SmartStore cache manager.
|
various settings | [clustering]
|
Includes various, mostly low-level, settings that control remote bucket operations in indexer clusters. |
cleanRemoteStorageByDefault = <bool>
|
[general]
|
Causes the splunk clean eventdata command to clean the remote indexes. Defaults to "false".
|
For details on these and other server.conf
settings, see server.conf.spec.
Most of the SmartStore server.conf
settings, including all of the common ones, are configured on the peer nodes. A few rarely-changed settings are configured instead on the master node. All settings configured on the peer nodes must be the same across all peer nodes.
SmartStore settings in limits.conf
The limits.conf
file contains several low-level search-related settings; for example, bucket_localize_max_timeout_sec
. These settings are primarily related to the process of localizing buckets. Do not change the settings without a clear understanding of the underlying processes.
For details on limits.conf
settings, see limits.conf.spec.
Settings in indexes.conf that are incompatible with SmartStore or otherwise restricted
SmartStore indexer clusters support a subset of features available in non-SmartStore indexer clusters. Settings related to incompatible features require special consideration.
In addition, SmartStore clusters handle certain needs, such as data retention, differently from non-SmartStore clusters. The associated settings are also different.
For information on features that are unsupported or restricted when using SmartStore, see:
The following indexes.conf
settings must remain unset:
bloomHomePath
summaryHomePath
tstatsHomePath
The following indexes.conf
settings must retain their default values:
createBloomfilter
. Do not change from default of true.enableOnlineBucketRepair
. Do not change from default of true.isReadOnly
. Do not change from default of false.journalCompression
. Do not change from default of gzip.enableTsidxReduction
. Do not change from default of false.maxDataSize
. Do not change from default of auto (recommended).
The following indexes.conf
settings are ignored by SmartStore:
maxWarmDBCount
maxTotalDataSizeMB
warmToColdScript
homePath.maxDataSizeMB
coldPath.maxDataSizeMB
Bootstrap SmartStore indexes onto an indexer cluster | Configure the SmartStore cache manager |
This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10
Feedback submitted, thanks!