Deployment Architecture

[smartstore] splunk smartstore and Data integrity

rbal_splunk
Splunk Employee
Splunk Employee

This question has come up a few times, how does Splunk handle data integrity in large ES implementation. On Splunk docs, it states 'Data integrity control feature. SmartStore-enabled indexes are not compatible with the data integrity control feature, described in Manage data integrity in the Securing Splunk Enterprise manual.

 


As covered in https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/AboutSmartStore

Labels (1)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

The best way to manage would be to enable s3 bucket versioning and s3 access logs.  Monitor for Splunk buckets with more than one version in s3.

if data integrity exists to detect alterations to splunk bucket data files, then s3 object versioning is a great way to detect alterations.

So, for smart store enabled indexes, integrity control is offloaded to the object storage. Typical implementations of version control and object logging can be utilized to have similar functionality of data integrity control.

youngsuh
Contributor

I have Enterprise security that need 6 months retention period.  Splunk Enterprise has 1 years retention period.  How does not have data integrity control affect way we work in Splunk Enterprise Security?  Does having more than one version of s3 bucket require more storage? 

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...