Does index clustering need to be used in order to use Smart Store?

[vonsolo29]

Do you have to use index clustering in order to use Smart Store? We currently have 4 standalone indexers that all UF are sending to and would like to use Smart Store.

[MuS]

Hi vonsolo29,

The docs tell you how to enable SmartStore on a standalone indexer https://docs.splunk.com/Documentation/Splunk/latest/Indexer/DeploySmartStorestandalone this means it is possible.

But I highly recommend to read this section of the docs as well https://docs.splunk.com/Documentation/Splunk/latest/Indexer/AboutSmartStore#Choosing_SmartStore when you consider to move to SmartStore.

Hope this helps ...

cheers, MuS

[vonsolo29]

yep i think that makes sense, so similar to how we have it set up today if an indexer goes down we can not search the data on that indexer. With remote storage it will be the same way, each indexer will manage its own buckets locally and remotely.

[MuS]

Exactly, only that those buckets can be in a remote S3 storage now instead on a local disk.

[vonsolo29]

Interesting, i was told by our splunk reps that SmartStore does not work with multiple standalone indexers. and we must use clustering

[MuS]

Each one of them can use SmartStore for its own storage, but they will not be able to share those SmartStore buckets like the index cluster nodes could - if that makes sense.