Configure the remote store for SmartStore
Before you configure SmartStore settings on the indexers, you must ensure that your remote store is properly set up, so that it is available to the indexers.
Later, when you configure remote volumes for SmartStore, you configure settings specific to the remote store in
indexes.conf. The indexer uses those settings to communicate with the remote store.
Supported remote storage services
Currently supported remote storage services are:
- S3-API-compliant object stores
To determine whether your object store is S3-compliant, use the S3 compatibility checking tool, located here: https://github.com/splunk/s3-tests. To use the tool, follow the instructions in the repository's README file.
Configure an S3 remote store
When configuring S3 buckets:
- The buckets must have read, write, and delete permissions.
- If the indexers are running on EC2, provision the buckets for the same region as the EC2 instances that use it.
See the Amazon S3 documentation for information on on how to create and configure buckets.
For S3-specific settings available through Splunk Enterprise, search for settings in the indexes.conf spec file that start with
For information on security-related settings, such as settings for S3 authentication and encryption, see SmartStore security strategies.
Accommodate the remote store addressing model
Amazon S3 currently supports two addressing models, or request URI styles: path style, or V1, and virtual-hosted style, or V2. In V1, the bucket name is in the URI path; for example,
//s3.amazonaws.com/<bucketname>/key. In V2, the bucket name is part of the domain name; for example,
Amazon is deprecating support for V1 and, going forward, will require requests for new S3 buckets to use the V2 model.
Splunk Enterprise remote store addressing for native S3
Splunk Enterprise accommodates both V1 and V2 models automatically for Amazon S3 buckets.You can use either model, but Splunk Enterprise will convert V1 URIs to V2 when communicating with S3.
Using the V1 model, you specify the URI like this:
[volume:s3volume] storageType = remote path = s3://<bucketname>/rest/of/path
Using the V2 model, you specify the URI like this:
[volume:s3volume] storageType = remote path = s3://rest/of/path remote.s3.bucket_name = <bucketname>
Similarly, if you specify an endpoint that ends in
amazonaws.com, Splunk Enterprise determines the URI version from the endpoint, since the structure is fixed. For example:
[volume:s3volume] storageType = remote path = s3://<bucketname>/rest/of/path remote.s3.endpoint = s3.us-west-1.amazonaws.com
[volume:s3volume] storageType = remote path = s3://rest/of/path remote.s3.endpoint = <bucketname>.s3.us-west-1.amazonaws.com
Both of these specify the same bucket, and Splunk Enterprise will correctly resolve either one.
Splunk Enterprise remote store addressing for S3-compatible remote stores
If you use an S3-compatible remote store, rather than native S3, you might need to specify the addressing model that the S3-compatible store supports. You need to specify the model only if the S3-compatible remote store does not support V1.
Splunk Enterprise provides the
remote.s3.url_version setting to specify the model that you are using. Its default value is v1. To change the addressing model to V2, change the setting to v2. For example:
[volume:s3volume] storageType = remote path = s3://rest/of/path remote.s3.url_version = v2 remote.s3.endpoint = bucketname.whatever.customer.com
SmartStore system requirements
Choose the storage location for each index
This documentation applies to the following versions of Splunk® Enterprise: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10
Feedback submitted, thanks!