Deployment Architecture

[smartstore] splunk smartstore and Data integrity

rbal_splunk
Splunk Employee
Splunk Employee

This question has come up a few times, how does Splunk handle data integrity in large ES implementation. On Splunk docs, it states 'Data integrity control feature. SmartStore-enabled indexes are not compatible with the data integrity control feature, described in Manage data integrity in the Securing Splunk Enterprise manual.

 


As covered in https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/AboutSmartStore

Labels (1)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

The best way to manage would be to enable s3 bucket versioning and s3 access logs.  Monitor for Splunk buckets with more than one version in s3.

if data integrity exists to detect alterations to splunk bucket data files, then s3 object versioning is a great way to detect alterations.

So, for smart store enabled indexes, integrity control is offloaded to the object storage. Typical implementations of version control and object logging can be utilized to have similar functionality of data integrity control.

youngsuh
Contributor

I have Enterprise security that need 6 months retention period.  Splunk Enterprise has 1 years retention period.  How does not have data integrity control affect way we work in Splunk Enterprise Security?  Does having more than one version of s3 bucket require more storage? 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...