Deployment Architecture

[smartstore] splunk smartstore and Data integrity

rbal_splunk
Splunk Employee
Splunk Employee

This question has come up a few times, how does Splunk handle data integrity in large ES implementation. On Splunk docs, it states 'Data integrity control feature. SmartStore-enabled indexes are not compatible with the data integrity control feature, described in Manage data integrity in the Securing Splunk Enterprise manual.

 


As covered in https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/AboutSmartStore

Labels (1)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

The best way to manage would be to enable s3 bucket versioning and s3 access logs.  Monitor for Splunk buckets with more than one version in s3.

if data integrity exists to detect alterations to splunk bucket data files, then s3 object versioning is a great way to detect alterations.

So, for smart store enabled indexes, integrity control is offloaded to the object storage. Typical implementations of version control and object logging can be utilized to have similar functionality of data integrity control.

youngsuh
Contributor

I have Enterprise security that need 6 months retention period.  Splunk Enterprise has 1 years retention period.  How does not have data integrity control affect way we work in Splunk Enterprise Security?  Does having more than one version of s3 bucket require more storage? 

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...