SmartStore custom resource reference

Reference for SmartStore Custom Resource spec parameters.

Additional SmartStore settings are available for tuning and storage management. These settings are equivalent to the SmartStore settings defined in indexes.conf and server.conf for Splunk Enterprise.

SmartStore spec

The SmartStore resource applies to the Standalone and ClusterManager Custom Resources, and adds the following spec configuration parameters:

PYTHON 
smartstore:
  description:
    Splunk Smartstore configuration. Refer to indexes.conf.spec and
    server.conf.spec on docs.splunk.com
  properties:
    cacheManager:
      description: Defines Cache manager settings
      properties:
        evictionPadding:
          description: Additional size beyond 'minFreeSize' before eviction kicks in
          type: integer
        evictionPolicy:
          description: Eviction policy to use
          type: string
        hotlistBloomFilterRecencyHours:
          description:
            Time period relative to the bucket's age, during which the bloom
            filter file is protected from cache eviction
          type: integer
        hotlistRecencySecs:
          description:
            Time period relative to the bucket's age, during which the bucket is
            protected from cache eviction
          type: integer
        maxCacheSize:
          description: Max cache size per partition
          type: integer
        maxConcurrentDownloads:
          description:
            Maximum number of buckets that can be downloaded from remote storage
            in parallel
          type: integer
        maxConcurrentUploads:
          description:
            Maximum number of buckets that can be uploaded to remote storage in
            parallel
          type: integer
      type: object
    defaults:
      description: Default configuration for indexes
      properties:
        maxGlobalDataSizeMB:
          description:
            MaxGlobalDataSizeMB defines the maximum amount of space for warm and
            cold buckets of an index
          type: integer
        maxGlobalRawDataSizeMB:
          description:
            MaxGlobalDataSizeMB defines the maximum amount of cumulative space
            for warm and cold buckets of an index
          type: integer
        volumeName:
          description: Remote Volume name
          type: string
      type: object
    indexes:
      description: List of Splunk indexes
      items:
        description: IndexSpec defines Splunk index name and storage path
        properties:
          hotlistBloomFilterRecencyHours:
            description:
              Time period relative to the bucket's age, during which the bloom
              filter file is protected from cache eviction
            type: integer
          hotlistRecencySecs:
            description:
              Time period relative to the bucket's age, during which the bucket
              is protected from cache eviction
            type: integer
          maxGlobalDataSizeMB:
            description:
              MaxGlobalDataSizeMB defines the maximum amount of space for warm
              and cold buckets of an index
            type: integer
          maxGlobalRawDataSizeMB:
            description:
              MaxGlobalDataSizeMB defines the maximum amount of cumulative space
              for warm and cold buckets of an index
            type: integer
          name:
            description: Splunk index name
            type: string
          remotePath:
            description: Index location relative to the remote volume path
            type: string
          volumeName:
            description: Remote Volume name
            type: string
        type: object
      type: array
    volumes:
      description: List of remote storage volumes
      items:
        description: VolumeSpec defines remote volume name and remote volume URI
        properties:
          endpoint:
            description: Remote volume URI
            type: string
          name:
            description: Remote volume name
            type: string
          path:
            description: Remote volume path
            type: string
          secretRef:
            description: Secret object name
            type: string
        type: object
      type: array
  type: object

SmartStore custom resource spec to Splunk configuration mapping

See indexes.conf and server.conf for more information about these configuration details.

Custom resource spec Splunk config Splunk stanza
volumeName + remotePath remotePath [<index name>], [default] in indexes.conf
maxGlobalDataSizeMB maxGlobalDataSizeMB [<index name>], [default] in indexes.conf
maxGlobalRawDataSizeMB maxGlobalRawDataSizeMB [<index name>], [default] in indexes.conf
hotlistRecencySecs hotlist_recency_secs [<index name>], [cachemanager]
hotlistBloomFilterRecencyHours hotlist_bloom_filter_recency_hours [<index name>], [cachemanager]
endpoint remote.s3.endpoint [volume:<name>]
path path [volume:<name>]
maxConcurrentUploads max_concurrent_uploads [cachemanager]
maxConcurrentDownloads max_concurrent_downloads [cachemanager]
maxCacheSize max_cache_size [cachemanager]
evictionPolicy eviction_policy [cachemanager]
evictionPadding eviction_padding [cachemanager]

Additional configuration

Some SmartStore and index configuration settings are not covered by the SmartStore custom resource spec. If you need to configure additional settings, use Splunk Apps:

  1. Create an app with the additional configuration. For example, to set the remote S3 encryption scheme as sse-s3, create an app with the following config in an indexes.conf file under the default or local subdirectory:
    CODE 
    [volume:<remote_volume_name>]
path = <remote_volume_path>
remote.s3.encryption = sse-s3
  2. Apply the CR with the necessary and supported SmartStore and index-related configurations.
  3. Install the app using the currently supported methods. You can combine this step with the previous step.

repFactor for internal indexes

For Indexer Clusters, SmartStore indexes must have repFactor set to auto. By default, the Cluster Manager _cluster app sets the repFactor to 0 for internal indexes like _metrics, _introspection, _telemetry, _metrics_rollup, and _configtracker. If you want to replicate these indexes, follow the instructions in the additional configuration section above to set the repFactor to auto.