Contenu
This hands-on module is designed to provide the essential knowledge for deploying and managing Splunk SmartStore.
It covers SmartStore deployment options, cache manager configurations, monitoring, and troubleshooting of SmartStore implementation.
A qui s'adresse cette formation
This 1- day module is designed for the experienced Splunk system administrators
Pré-requis
Required:
Strongly recommended:
- Troubleshooting Splunk Enterprise (TSE)
- Working knowledge of:
- Linux OS commands
- Editing files with vi or nano
- Splunk index life-cycle and bucket transitions
- Splunk Indexer cluster concept
Objectifs
- Introduction to SmartStore
- Standalone SmartStore Implementation
- SmartStore in Indexer Cluster
- Monitoring and managing SmartStore
Outline: Implementing Splunk SmartStore (ISS)
Topic 1 – Introduction to SmartStore
- Benefits of SmartStore
- SmartStore requirements and restrictions
- Indexing in SmartStore
- Searching in SmartStore
Topic 2 – Standalone SmartStore Implementation
- Enabling SmartStore indexes
- Bootstrapping SmartStore indexes
- Validating the implementation
Topic 3 – SmartStore in Indexer Cluster
- Implementation differences between deployments
- SmartStore in an indexer cluster
- SmartStore migration in indexer clusters
Topic 4 – Monitoring and managing SmartStore
- Monitoring SmartStore activities
- Cache manager settings
- Optimizing eviction policies