Getting Data In

Can we enable WORM on SmartStore S3 buckets ?

dm1
Contributor

Does Splunk support enabling WORM on SmartStore S3 buckets ?

Labels (2)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The docs don't mention it, but I'd say no.

Splunk buckets (other than hot buckets) are, by nature, WORM.  They are never changed once written.  However, the metadata associated with a bucket can change if, for example, a datamodel changes then the associated tsidx file in the bucket will have to change.  That would not work if the S3 bucket was write-protected.

In short, don't mess with SmartStore buckets.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The docs don't mention it, but I'd say no.

Splunk buckets (other than hot buckets) are, by nature, WORM.  They are never changed once written.  However, the metadata associated with a bucket can change if, for example, a datamodel changes then the associated tsidx file in the bucket will have to change.  That would not work if the S3 bucket was write-protected.

In short, don't mess with SmartStore buckets.

---
If this reply helps you, Karma would be appreciated.

dm1
Contributor

That makes sense. Thanks for your helpful answer @richgalloway 

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...