Getting Data In

Are Smartstore buckets uploaded to S3 immutable?

thormanrd
Path Finder

Are Smartstore buckets uploaded to S3 immutable?  We've been using Smartstore for almost a year and I have never seen an update to a bucket after its original upload to S3.  Can anyone confirm this?

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Just like warm and cold on-prem buckets, S2 buckets never change.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

pBear
Explorer

The whole S3 SmartStore bucket is not immutable. At least in my instance anyway.
The actual index data, tsidx files, and other metadata files subtending the 'db' folder are immutable.

However, data model acceleration files located under the 'dma' folder do get updated/deleted as a normal part of Splunk operation.

Do we have something misconfigured here? Or, is what am what I am saying normal?

richgalloway
SplunkTrust
SplunkTrust

That's normal and is just like on-prem.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Just like warm and cold on-prem buckets, S2 buckets never change.

---
If this reply helps you, Karma would be appreciated.

cybersecnutant
Explorer

As I am learning with Write-Once-Read-Many (WORM), there are situations where the buckets/tsidx files are re-uploaded when the indexers have hiccups during an upload.

https://community.splunk.com/t5/Deployment-Architecture/smartstore-splunk-smartstore-and-Data-integr...

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...