Deployment Architecture

[smartstore] splunk smartstore and Data integrity

rbal_splunk
Splunk Employee
Splunk Employee

This question has come up a few times, how does Splunk handle data integrity in large ES implementation. On Splunk docs, it states 'Data integrity control feature. SmartStore-enabled indexes are not compatible with the data integrity control feature, described in Manage data integrity in the Securing Splunk Enterprise manual.

 


As covered in https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/AboutSmartStore

Labels (1)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

The best way to manage would be to enable s3 bucket versioning and s3 access logs.  Monitor for Splunk buckets with more than one version in s3.

if data integrity exists to detect alterations to splunk bucket data files, then s3 object versioning is a great way to detect alterations.

So, for smart store enabled indexes, integrity control is offloaded to the object storage. Typical implementations of version control and object logging can be utilized to have similar functionality of data integrity control.

youngsuh
Contributor

I have Enterprise security that need 6 months retention period.  Splunk Enterprise has 1 years retention period.  How does not have data integrity control affect way we work in Splunk Enterprise Security?  Does having more than one version of s3 bucket require more storage? 

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...