Course Content
This hands-on module is designed to provide the essential knowledge for deploying and managing Splunk SmartStore.
It covers SmartStore deployment options, cache manager configurations, monitoring, and troubleshooting of SmartStore implementation.
Who should attend
This 1- day module is designed for the experienced Splunk system administrators
Prerequisites
Required:
Strongly recommended:
- Troubleshooting Splunk Enterprise (TSE)
- Working knowledge of:
- Linux OS commands
- Editing files with vi or nano
- Splunk index life-cycle and bucket transitions
- Splunk Indexer cluster concept
Course Objectives
- Introduction to SmartStore
- Standalone SmartStore Implementation
- SmartStore in Indexer Cluster
- Monitoring and managing SmartStore
Outline: Implementing Splunk SmartStore (ISS)
Topic 1 – Introduction to SmartStore
- Benefits of SmartStore
- SmartStore requirements and restrictions
- Indexing in SmartStore
- Searching in SmartStore
Topic 2 – Standalone SmartStore Implementation
- Enabling SmartStore indexes
- Bootstrapping SmartStore indexes
- Validating the implementation
Topic 3 – SmartStore in Indexer Cluster
- Implementation differences between deployments
- SmartStore in an indexer cluster
- SmartStore migration in indexer clusters
Topic 4 – Monitoring and managing SmartStore
- Monitoring SmartStore activities
- Cache manager settings
- Optimizing eviction policies