Getting Data In

Can we enable WORM on SmartStore S3 buckets ?

dm1
Communicator

Does Splunk support enabling WORM on SmartStore S3 buckets ?

Labels (2)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The docs don't mention it, but I'd say no.

Splunk buckets (other than hot buckets) are, by nature, WORM.  They are never changed once written.  However, the metadata associated with a bucket can change if, for example, a datamodel changes then the associated tsidx file in the bucket will have to change.  That would not work if the S3 bucket was write-protected.

In short, don't mess with SmartStore buckets.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The docs don't mention it, but I'd say no.

Splunk buckets (other than hot buckets) are, by nature, WORM.  They are never changed once written.  However, the metadata associated with a bucket can change if, for example, a datamodel changes then the associated tsidx file in the bucket will have to change.  That would not work if the S3 bucket was write-protected.

In short, don't mess with SmartStore buckets.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

dm1
Communicator

That makes sense. Thanks for your helpful answer @richgalloway 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!