topic Are Smartstore buckets uploaded to S3 immutable? in Getting Data In

Are Smartstore buckets uploaded to S3 immutable?

thormanrd — Mon, 25 Sep 2023 22:56:04 GMT

Are Smartstore buckets uploaded to S3 immutable? We've been using Smartstore for almost a year and I have never seen an update to a bucket after its original upload to S3. Can anyone confirm this?

Re: Smartstore Buckets Immutability

richgalloway — Fri, 12 Feb 2021 21:28:20 GMT

Just like warm and cold on-prem buckets, S2 buckets never change.

Re: Smartstore Buckets Immutability

pBear — Mon, 25 Sep 2023 21:52:52 GMT

The whole S3 SmartStore bucket is not immutable. At least in my instance anyway.
The actual index data, tsidx files, and other metadata files subtending the 'db' folder are immutable.

However, data model acceleration files located under the 'dma' folder do get updated/deleted as a normal part of Splunk operation.

Do we have something misconfigured here? Or, is what am what I am saying normal?

Re: Smartstore Buckets Immutability

richgalloway — Tue, 26 Sep 2023 11:52:32 GMT

That's normal and is just like on-prem.

Re: Smartstore Buckets Immutability

cybersecnutant — Thu, 29 Aug 2024 15:53:37 GMT

As I am learning with Write-Once-Read-Many (WORM), there are situations where the buckets/tsidx files are re-uploaded when the indexers have hiccups during an upload.

https://community.splunk.com/t5/Deployment-Architecture/smartstore-splunk-smartstore-and-Data-integrity/m-p/506769