Configure SmartStore for a standalone instance

Configure SmartStore remote storage for a Standalone Splunk deployment.

Configure SmartStore remote storage for a Standalone Splunk deployment using a Custom Resource specification.

  1. Configure remote store credentials using one of the following methods:
    • Configure IAM role-based credentials through a service account or annotations.
    • Create a Secret object with secret and access credentials as described in the SmartStore secrets topic.
  2. Confirm your S3-based storage volume path and URL.
  3. Confirm the name of the Splunk indexes to use with the SmartStore volume.
  4. Create or update the Standalone custom resource specification with volume and index configuration.

    Example Standalone.yaml:

    CODE 
    apiVersion: enterprise.splunk.com/v4
kind: Standalone
metadata:
  name: s1
  finalizers:
  - enterprise.splunk.com/delete-pvc
spec:
  smartstore:
    defaults:
      volumeName: s2s3_vol
    indexes:
      - name: networkmonitor
        volumeName: s2s3_vol
        remotePath: $_index_name
      - name: salesdata
      - name: oslogs
    volumes:
      - name: s2s3_vol
        path: indexdata-s2-bucket/standaloneNodes/s1data/
        endpoint: https://s3-us-west-2.amazonaws.com
        secretRef: s3-secret

    In this example:

    1. indexdata-s2-bucket is the bucket name on remote storage and standaloneNodes/s1data is the relative path on that bucket where the index data is stored.
    2. Three indexes are defined: networkmonitor, salesdata, and oslogs.
    3. The defaults section is configured with the S3 volumeName parameter. An index can override with a specific volumeName, as shown for the networkmonitor index. Unless you use multiple S3 volumes, specifying the volumeName in the defaults section avoids repeating it across all indexes.
    4. If the remotePath is not explicitly specified, a default value of $_index_name is assumed. For the semantics of $_index_name, see indexes.conf in Splunk documentation.
  5. Apply the custom resource specification:
    CODE 
    kubectl apply -f Standalone.yaml

The SmartStore parameters are placed into the required .conf files in an app named splunk-operator. For a standalone deployment, the app is located at /opt/splunk/etc/apps/.

Note: Custom apps with higher precedence can potentially overwrite the index and volume configuration in the splunk-operator app. Avoid conflicting SmartStore configuration in custom apps. See Configuration file precedence order.