Monitoring Splunk

Smartstore S3 data retention period

mufthmu
Path Finder

Hello fellow Splunkers,

I have 2 questions regarding Splunk Smartstore's cachemanager:

1. How do I make sure that my cachemanager is large enough to hold all warm buckets for 30 days? My daily license usage is about 15-20GB/day and my Splunk is hosted in the cloud.

2. What config/parameters are responsible if I want to delete data that were archived in my remote storage (S3) if their age reach 60 days since the day they got archived OR 90 days since the data creation?

for example: I set my frozenTimePeriodInSecs to be 90 days. But just after 30 days the data leave cache manager and will be archived in S3. So when that same data reach their 90th day, how can cache manager freeze/delete that data if it's sitting in S3 bucket?

Thanks!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

1. This is out of your hands.  Splunk Cloud will manage the cache for you.  

2. The buckets stored in S3 are managed for you by Splunk.  Despite the location, they're still Splunk buckets and still subject to the normal retention mechanism.  Don't do anything to them yourself.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

1. This is out of your hands.  Splunk Cloud will manage the cache for you.  

2. The buckets stored in S3 are managed for you by Splunk.  Despite the location, they're still Splunk buckets and still subject to the normal retention mechanism.  Don't do anything to them yourself.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...