Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Splunk Enterprise version 9.0 will no longer be supported as of June 14, 2024. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.

Choose the storage location for each index

You can configure SmartStore globally, using the same settings for all indexes, or you can configure SmartStore on a per-index basis. If you configure SmartStore on a per-index basis, you can have a mix of SmartStore and non-SmartStore indexes on the same indexer or indexer cluster. You can also specify different remote volumes for different SmartStore indexes.

The remote volume, defined in indexes.conf, points to the remote store where SmartStore stores warm buckets, such as a location on an S3 bucket, a GCS bucket, or an Azure Blob storage container.

To summarize, you can choose from these storage options:

  • All indexes stored remotely, on a single volume.
  • All indexes stored remotely, on multiple volumes.
  • Some indexes stored locally, with others stored remotely on one or more remote volumes.

Even with a SmartStore index, some index data is temporarily stored locally, in the cache. However, except for hot buckets, the index's master copies of buckets are stored remotely. For the sake of simplicity, the list of storage options assumes the index's master copies when discussing storage volumes and does not consider data stored locally in the SmartStore cache.

Keep these limitations in mind:

  • Each remote volume is limited to a single indexer cluster or standalone indexer. That is, each remote store holds buckets for only a single cluster or standalone indexer. From the configuration standpoint, the path setting within each remote volume stanza in indexes.conf must be unique to the cluster or indexer. For example, if indexes on one cluster use a particular remote volume, no index on any other cluster or standalone indexer can uses the same remote volume.
  • Each SmartStore index is limited to a single remote volume. All warm buckets for that index must reside in the same remote store.
  • Each indexer or indexer cluster is limited to a single remote storage type across all indexes. The available remote storage types are S3, GCS, or Azure Blob storage.
  • All peer nodes on an indexer cluster must use the same SmartStore settings.
Last modified on 21 July, 2021
Configure the Azure Blob remote store for SmartStore   SmartStore on S3 security strategies

This documentation applies to the following versions of Splunk® Enterprise: 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.3.1, 9.3.2


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters