Splunk® Enterprise

Managing Indexers and Clusters of Indexers

Add a SmartStore index

The process of adding a SmartStore index is similar to adding a non-SmartStore index. You create a new index stanza in indexes.conf and configure path information and other settings.

You cannot add, edit, or delete a SmartStore index through Splunk Web.



Add a SmartStore index by directly editing indexes.conf

You can add a SmartStore index by directly editing indexes.conf. You can use this method with both indexer clusters and standalone indexers.

As with all indexes.conf settings, use the configuration bundle method when adding an index to the peer nodes on an indexer cluster.

Note the following:

  • SmartStore-related settings in indexes.conf are usually configured at the global level, not at the individual index level. In that case, it is unlikely that you will need to specify those settings when adding a new index. However, if you are using multiple remote volumes or if you have a mix of SmartStore and non-SmartStore indexes, you must specify the SmartStore settings at the index level.
  • If the SmartStore settings are configured globally, then a new index stanza usually needs only the homePath, thawedPath, and coldPath settings. You must specify values for coldPath and thawedPath, even though SmartStore does not use those settings.
  • Use maxDataSize = auto (the default value, which is 750MB).
  • In the case of indexer clusters, you must specify repFactor = auto .
  • See SmartStore settings in indexes.conf for a list of relevant SmartStore settings.

For example, assume that you have already set all SmartStore-related configurations at the global level. Then, to configure a new index called "cs_index", just add the following stanza to indexes.conf:

homePath = $SPLUNK_DB/cs_index/db
thawedPath = $SPLUNK_DB/cs_index/thaweddb
coldPath = $SPLUNK_DB/cs_index/colddb
Last modified on 24 March, 2020
Configure data retention for SmartStore indexes   Troubleshoot SmartStore

This documentation applies to the following versions of Splunk® Enterprise: 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.2.0, 9.2.1

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters