Knowledge Management

[SmartStore] Can I get key configuration for Smart Store?

rbal_splunk
Splunk Employee
Splunk Employee

I am planning to setup SmartStore and was looking for Key configuration. Could you please share the Key configuration?

0 Karma

masonmorales
Influencer

As you're a Splunker, I'd encourage you to search our internal Confluence. You'll find several examples in there.

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Implementing Enabling SmartStore

Volume Configuration:

indexes.conf

[volume:<volumne_name>]
storageType = remote
path = <scheme>/<remote-location-specifier>
remote.s3.endpoint = <URL of S3 API>
remote.s3.secret_key =
remote.s3.access_key = 

Index Configuration:
indexes.conf

  [index_name]
    homePath =
    coldPath = <path required ,but not used>
    remotePath = <volumn_name>/>index_name>
    maxGlobalDataSizeMB = 
    drozenTimePeriodInSecs = 

Note: You can have a mix of S2 and classic indexes on the same indexes

CacheManager Configuration

[cacahemanager]
max_cache_size = <MB pf cache size to use, where we start trigger eviction,default 0
eviction_padding = <MB of padding space,where minFreeDisk+padding starts trigger eviction, deafult 5GB
eviction_policy = lru
0 Karma

indreshdowjones
Explorer

could you please share sample configuration for smart store for the following files as well ? as

  • server.conf
  • limits.conf

as per documentation the key files are indexes.conf and server.conf
- limits.conf
https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/ConfigureSmartStore

so can you please share ?

0 Karma

indreshdowjones
Explorer

Is there any sample configuration file for smart store ?
- indexes.conf
- server.conf
- limits.conf

0 Karma

bsrikanthreddy5
Path Finder

I am moving the existing environment Splunk 7.0 to Splunk 7.2.4 with smartstore. Can you please provide the all setting need to be set to default, disabled, ignored ...
Thanks in advance.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...