Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Choose the storage location for each index

You can configure SmartStore globally, using the same settings for all indexes, or you can configure SmartStore on a per-index basis. If you configure SmartStore on a per-index basis, the indexer cluster can have both SmartStore and non-SmartStore indexes.

You can specify different remote storage volumes for different SmartStore indexes.

The "remote storage volume" is the remote location where SmartStore stores warm buckets, such as a location on an S3 bucket.

To summarize, you can choose from these storage options:

  • All indexes stored remotely, on a single volume.
  • All indexes stored remotely, on multiple volumes.
  • Some indexes stored locally, with others stored remotely on one or more remote volumes.

Even with a SmartStore index, some index data is temporarily stored locally, in the cache. However, except for hot buckets, the index's master copies of buckets are stored remotely. For the sake of simplicity, the list of storage options assumes the index's master copies when discussing storage volumes and does not consider data stored locally in the SmartStore cache.

Keep these limitations in mind:

  • Each SmartStore index is limited to a single remote volume.
  • Each indexer cluster is limited to a single remote storage type across all indexes. At this time, the only type of remote storage that SmartStore supports is S3, including S3-compatible stores.
  • You cannot share remote volumes across multiple indexer clusters. In other words, the path setting within each remote volume stanza in indexes.conf must be unique to that cluster. For example, if indexes on one cluster use a particular remote volume, no index on any other cluster can uses the same remote volume.
  • All peer nodes on an indexer cluster must use the same SmartStore settings.
PREVIOUS
Configure the remote store for SmartStore
  NEXT
SmartStore security strategies

This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters