Unlocking reliability with Splunk SmartStore

This post details Atlassian's migration of its Splunk deployment from traditional EC2 instances with local NVMe storage to a SmartStore-enabled architecture utilizing AWS S3 for warm buckets. The migration addressed operational complexity and scaling challenges associated with growing log ingestion volumes. Key aspects include planning for minimal downtime and data loss, designing S3 gateway endpoints and bucket policies, configuring Splunk's `eviction_policy` to `lruk`, and automating the implementation using Ansible. The post highlights the successful decoupling of storage from compute, enabling reduced indexer node counts and improved scalability.