topic SmartStore Cache Policy to Preserve Recent Buckets while searching from S3 Object Store in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/SmartStore-Cache-Policy-to-Preserve-Recent-Buckets-while/m-p/502759#M8897 <P>I want to balance the use of cache capacity with SmartStore. I want to keep recent buckets in cache while allowing older buckets to be expired so I can search with the S3 object store.</P> <P>Based on what I read in...</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/ConfigureSmartStorecachemanager" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/ConfigureSmartStorecachemanager</A></P> <P>I believe setting "hotlist_recency_secs" and "hotlist_bloom_filter_recency_hours" would allow me to accomplish what I seek. i.e. protect buckets processed within the last 7 days and use remaining cache capacity for buckets retrieved from S3.</P> <P>Can someone confirm my logic or point me in the right direction?</P> <P>thx<BR /> -v</P> Wed, 30 Sep 2020 04:45:34 GMT stewdapew 2020-09-30T04:45:34Z SmartStore Cache Policy to Preserve Recent Buckets while searching from S3 Object Store https://community.splunk.com/t5/Splunk-Enterprise-Security/SmartStore-Cache-Policy-to-Preserve-Recent-Buckets-while/m-p/502759#M8897 <P>I want to balance the use of cache capacity with SmartStore. I want to keep recent buckets in cache while allowing older buckets to be expired so I can search with the S3 object store.</P> <P>Based on what I read in...</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/ConfigureSmartStorecachemanager" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/ConfigureSmartStorecachemanager</A></P> <P>I believe setting "hotlist_recency_secs" and "hotlist_bloom_filter_recency_hours" would allow me to accomplish what I seek. i.e. protect buckets processed within the last 7 days and use remaining cache capacity for buckets retrieved from S3.</P> <P>Can someone confirm my logic or point me in the right direction?</P> <P>thx<BR /> -v</P> Wed, 30 Sep 2020 04:45:34 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/SmartStore-Cache-Policy-to-Preserve-Recent-Buckets-while/m-p/502759#M8897 stewdapew 2020-09-30T04:45:34Z