hello Splunkers , Need some clarification on Smartstore data migration. as per the docs , You can still search any existing buckets that were tsidx-reduced before migration to SmartStore. e.g. we have 18 months of data retention. We need to keep 6 months of data in local/cache storage due to frequent audit/forensic searches that need raw data fields. questions: 1> is it possible to migrate tsidx reduced buckets to obj store without need for rebuild & Indexer cluster will still search them as normal ( slower) process for tsidx reduced buckets ? OR do we need to rebuild all buckets before initiating data migration to obj store. in our case then we need to rebuild all the buckets from 7 to 18 months! In some cases we may run out of local space if we have to do this 😐 2> What is the performance impact to search reduced bucket with addition of smartstore. Since cache manager has to fetch bucket from remote store & then rebuild it locally in cache(?) before it being searchable , the two levels of performance hit is too much? Anyone have had such a situation. thanks for your attention 🙂 Manduki https://docs.splunk.com/Documentation/Splunk/latest/Indexer/AboutSmartStore Tsidx reduction. Do not set enableTsidxReduction to "true". Tsidx reduction modifies bucket contents and is not supported by SmartStore. Note: You can still search any existing buckets that were tsidx-reduced before migration to SmartStore. As with non-SmartStore deployments such searches will likely run slowly.
... View more
