Skip to main content

Splunk Training + Certification

Implementing Splunk SmartStore

Course Description

This course is designed for the experienced Splunk system administrator. This hands-on class is designed to provide the essential knowledge for deploying and managing Splunk SmartStore.  It covers SmartStore deployment options, cache manager configurations, monitoring, and troubleshooting of SmartStore implementation.

Instructor-led Training Schedule

Course Prerequisites

  • Splunk Enterprise System Administration
  • Splunk Enterprise Data Administration
Strongly recommended:
  • Troubleshooting Splunk Enterprise
  • Working knowledge of Linux OS commands, editing files with vi or nano, Splunk index life-cycle and bucket transitions, and Splunk Indexer cluster concepts

Course Topics

  • Introduction to SmartStore
  • Standalone SmartStore Implementation
  • SmartStore in Indexer Cluster
  • Monitoring and managing SmartStore

Course Objectives

Module 1 – Introduction to SmartStore
  • Benefits of SmartStore
  • SmartStore requirements and restrictions
  • Indexing in SmartStore
  • Searching in SmartStore
Module 2 – Standalone SmartStore Implementation
  • Enabling SmartStore indexes
  • Bootstrapping SmartStore indexes
  • Validating the implementation
Module 3 – SmartStore in Indexer Cluster
  • Implementation differences between deployments
  • SmartStore in an indexer cluster
  • SmartStore migration in indexer clusters


Module 4 – Monitoring and managing SmartStore
  • Monitoring SmartStore activities
  • Cache manager settings
  • Optimizing eviction policies