Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Splunk Enterprise version 7.2 is no longer supported as of April 30, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Configure the remote store for SmartStore

Before you configure SmartStore settings on the indexers, you must ensure that your remote store is properly set up, so that it is available to the indexers.

Later, when you configure remote volumes for SmartStore, you configure settings specific to the remote store in indexes.conf. The indexer uses those settings to communicate with the remote store.

Supported remote storage services

Currently supported remote storage services are:

  • S3
  • S3-API-compliant object stores

To determine whether your object store is S3-compliant, use the S3 compatibility checking tool, located here: https://github.com/splunk/s3-tests. To use the tool, follow the instructions in the repository's README file.

Configure an S3 remote store

When configuring S3 buckets:

  • The buckets must have read, write, and delete permissions.
  • If the indexers are running on EC2, provision the buckets for the same region as the EC2 instances that use it.

See the Amazon S3 documentation for information on on how to create and configure buckets.

For S3-specific settings available through Splunk Enterprise, search for settings in the indexes.conf spec file that start with remote.s3.

For information on security-related settings, such as settings for S3 authentication and encryption, see SmartStore security strategies.

Last modified on 23 September, 2019
SmartStore system requirements   Choose the storage location for each index

This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters