[smartstore] splunk smartstore and Data integrity

[rbal_splunk]

This question has come up a few times, how does Splunk handle data integrity in large ES implementation. On Splunk docs, it states 'Data integrity control feature. SmartStore-enabled indexes are not compatible with the data integrity control feature, described in Manage data integrity in the Securing Splunk Enterprise manual.

As covered in https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/AboutSmartStore

[rbal_splunk]

The best way to manage would be to enable s3 bucket versioning and s3 access logs.  Monitor for Splunk buckets with more than one version in s3.

if data integrity exists to detect alterations to splunk bucket data files, then s3 object versioning is a great way to detect alterations.

So, for smart store enabled indexes, integrity control is offloaded to the object storage. Typical implementations of version control and object logging can be utilized to have similar functionality of data integrity control.

[youngsuh]

I have Enterprise security that need 6 months retention period.  Splunk Enterprise has 1 years retention period.  How does not have data integrity control affect way we work in Splunk Enterprise Security?  Does having more than one version of s3 bucket require more storage?