Configure SmartStore for the Splunk Operator

Configure SmartStore remote storage volumes and indexes for the Splunk Operator.

The Splunk Operator includes a method for configuring a SmartStore remote storage volume with index support using a Custom Resource.

Note: Starting with Splunk Operator version 1.0.2, use the App Framework to set up SmartStore indexes and configuration. You can still use the Custom Resource method to specify S3 access keys, which avoids storing them in the S3 buckets through the App Framework. For more information, see App Framework.

The Splunk Operator does not implement SmartStore integration as a StorageClass. This feature and its settings rely on support integrated into Splunk Enterprise. See SmartStore for information on the feature and implementation considerations.

  • The following Custom Resources support SmartStore configuration: Standalone and ClusterManager.
  • The Splunk Operator limits SmartStore support to Amazon S3 and S3-API-compliant object stores only if you are using the CRD configuration for S3 as described in this guide.
  • For Amazon S3, if you are using interface VPC endpoints with DNS enabled to access AWS S3, update the corresponding volume endpoint URL with one of the DNS names from the endpoint. Ensure that the endpoint has access to the S3 buckets using the credentials configured. You can also use other endpoint URLs with access to the S3 buckets.
  • To use GCS or Azure with SmartStore, configure through a Splunk App and use AppFramework to deploy it. If you do not want the credentials inside the app, you can also set up Managed Identity or Workload Identity.
  • The specification allows definition of SmartStore-enabled indexes only.
  • Migrate existing index data from local storage to the remote store as a prerequisite before configuring those indexes in the Custom Resource of the Splunk Operator. For more details, see Migrate existing data on an indexer cluster to SmartStore.

SmartStore configuration involves indexes, volumes, and the volume credentials. You configure indexes and volume settings through the Custom Resource specification. You can configure the credentials for accessing the volume through either IAM roles or static credentials. For roles, configure through service accounts or annotations. For static keys, store the volume credentials securely in a Kubernetes secret object, and reference that secret object from the Custom Resource with SmartStore volume spec through secretRef.

Store SmartStore secrets

The following example command encodes and loads your static remote storage volume secret key and access key in the Kubernetes secret object:

CODE 
kubectl create secret generic <secret_store_obj> --from-literal=s3_access_key=<access_key> --from-literal=s3_secret_key=<secret_key>

Example:

CODE 
kubectl create secret generic s3-secret --from-literal=s3_access_key=<your_access_key> --from-literal=s3_secret_key=<your_secret_key>