Configure Splunk level settings

Splunk and Elastic

Audience
Public
Product
FlashBlade
FlashArray
FlashBlade > Purity//FB
FlashArray > Purity//FA
Technology Integrations
Splunk and Elastic
Source Type
Documentation

For Splunk Multisite SmartStore requirements and pre-requisites please check Splunk’s documentation.

Please see the “Splunk SmartStore Architecture” section within the Best Practices for Splunk on Everpure and configure the remote storage sections within the indexes.conf to point to the FlashBlade.

1. Configure Replication Timeout

The parameter remote_storage_upload_timeout under [clustering] stanza on the server.conf for all the indexers across the site should be set to a time (in seconds) higher than the maximum replication lag time between the two FlashBlades. The recommended settings is 600 (10 minutes). This setting should be updated to a higher value if you notice the replication lag goes beyond 600 seconds.