Splunk SmartStore
Splunk SmartStore is a functionality for Splunk deployments that leverages S3 object storage as back-end storage to provide scalability and economic benefits. SmartStore re-engineers the traditional Splunk architecture that uses dedicated storage for each indexer with hot, warm, and cold tiers, by instead combining a local hot tier on the indexer nodes with a single warm tier residing on an object storage layer.
As in a traditional Splunk deployment, the most recent and frequently accessed data is kept in hot buckets on indexers and moved to a lower cost tier as it cools down. In a SmartStore deployment however, when data is rolled over to the warm tier, the warm data is then maintained as the master copy. Data can then be dynamically copied from the warm tier back to the hot tier by the SmartStore cache manager as it is needed, while the master copy is maintained and protected by object storage on the warm tier. With the economics of object storage, an additional cold tier is not necessary and can be consolidated into the warm tier.
The SmartStore architecture is useful for Splunk deployments with large data requirements. The use of a single warm tier residing on object storage decouples compute and storage resources, permitting storage to scale independently as needed without requiring additional, costly compute resources. Additionally, storing the master copy of data on object storage provides built-in protection and the economic characteristics of object storage allow the traditional architecture to be greatly simplified down to two tiers.
Download now to read the full, free Technical Insight report.
