https://community.splunk.com/t5/Knowledge-Management/SmartStore-SmartStore-and-POST-to-the-cachemanager-endpoint-for/m-p/416225#M3649 <P>There is a POST to open and a POST to close bucket (or summary) as it's needed by search. POST's don't always correspond 1:1 to what you see in audit.log. if the bucket is already local, you won't see anything in audit.log.</P> Mon, 21 Jan 2019 22:27:07 GMT rbal_splunk 2019-01-21T22:27:07Z https://community.splunk.com/t5/Knowledge-Management/SmartStore-SmartStore-and-POST-to-the-cachemanager-endpoint-for/m-p/416224#M3648 <P>in an SmartStore environment, when a search is executed on the indexers, is there always a post to the cachemanager endpoint?<BR /> for example - would i expect to see the same count of POST's to close a bucket out as I would see in the audit.log under things such as searched_buckets or invocations.command.search.index.bucketcache.hit?</P> Mon, 21 Jan 2019 22:26:36 GMT https://community.splunk.com/t5/Knowledge-Management/SmartStore-SmartStore-and-POST-to-the-cachemanager-endpoint-for/m-p/416224#M3648 rbal_splunk 2019-01-21T22:26:36Z https://community.splunk.com/t5/Knowledge-Management/SmartStore-SmartStore-and-POST-to-the-cachemanager-endpoint-for/m-p/416225#M3649 <P>There is a POST to open and a POST to close bucket (or summary) as it's needed by search. POST's don't always correspond 1:1 to what you see in audit.log. if the bucket is already local, you won't see anything in audit.log.</P> Mon, 21 Jan 2019 22:27:07 GMT https://community.splunk.com/t5/Knowledge-Management/SmartStore-SmartStore-and-POST-to-the-cachemanager-endpoint-for/m-p/416225#M3649 rbal_splunk 2019-01-21T22:27:07Z