topic Re: Can we enable WORM on SmartStore S3 buckets ? in Getting Data In

Can we enable WORM on SmartStore S3 buckets ?

dm1 — Mon, 27 Sep 2021 23:03:39 GMT

Does Splunk support enabling WORM on SmartStore S3 buckets ?

Re: Can we enable WORM on SmartStore S3 buckets ?

richgalloway — Tue, 28 Sep 2021 14:39:32 GMT

The docs don't mention it, but I'd say no.

Splunk buckets (other than hot buckets) are, by nature, WORM. They are never changed once written. However, the metadata associated with a bucket can change if, for example, a datamodel changes then the associated tsidx file in the bucket will have to change. That would not work if the S3 bucket was write-protected.

In short, don't mess with SmartStore buckets.

Re: Can we enable WORM on SmartStore S3 buckets ?

dm1 — Tue, 28 Sep 2021 23:09:46 GMT

That makes sense. Thanks for your helpful answer @richgalloway