Implementing Splunk SmartStore
Course Description

This course is designed for the experienced Splunk system administrator. This hands-on class is designed to provide the essential knowledge for deploying and managing Splunk SmartStore.  It covers SmartStore deployment options, cache manager configurations, monitoring, and troubleshooting of SmartStore implementation.

Instructor-led Training Schedule

Course Prerequisites

Required:

  • Splunk Enterprise System Administration
  • Splunk Enterprise Data Administration

Strongly recommended:

  • Troubleshooting Splunk Enterprise
  • Working knowledge of Linux OS commands, editing files with
    vi or nano, Splunk index life-cycle and bucket transitions, and Splunk Indexer
    cluster concepts

 

Course Topics

  • Introduction to SmartStore
  • Standalone SmartStore Implementation
  • SmartStore in Indexer Cluster
  • Monitoring and managing SmartStore
Course Objectives

Module 1 – Introduction to SmartStore

  • Benefits of SmartStore
  • SmartStore requirements and restrictions
  • Indexing in SmartStore
  • Searching in SmartStore

Module 2 – Standalone SmartStore Implementation

  • Enabling SmartStore indexes
  • Bootstrapping SmartStore indexes
  • Validating the implementation

Module 3 – SmartStore in Indexer Cluster

  • Implementation differences between deployments
  • SmartStore in an indexer cluster
  • SmartStore migration in indexer clusters

Module 4 – Monitoring and managing SmartStore

  • Monitoring SmartStore activities
  • Cache manager settings
  • Optimizing eviction policies