According to https://docs.splunk.com/Documentation/Splunk/8.0.3/Indexer/AboutSmartStore#Current_restrictions_on_SmartStore_use "For multisite clusters, if any SmartStore indexes use report acceleration or data model acceleration, you must disable search affinity by setting all search heads to site0 ." Since Splunk Enterprise Security uses data model acceleration, would I be ill-advised to implement ES on SmartStore in a 2-site configuration? I'm concerned about performance. Help with this will be much appreciated! ... View more

I'm considering using an on-premises S3 object store for warm buckets and keeping it in sync with an AWS S3 object store, external to Splunk. If my local object store fails, how do I switch to the AWS S3 object store? Is it as simple as changing the path parameters and restarting the indexers? The context is disaster recovery. ... View more