Knowledge Management

[SmartStore] SmartStore and POST to the cachemanager endpoint for Open/Close of Bucket?

rbal_splunk
Splunk Employee
Splunk Employee

in an SmartStore environment, when a search is executed on the indexers, is there always a post to the cachemanager endpoint?
for example - would i expect to see the same count of POST's to close a bucket out as I would see in the audit.log under things such as searched_buckets or invocations.command.search.index.bucketcache.hit?

Tags (1)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

There is a POST to open and a POST to close bucket (or summary) as it's needed by search. POST's don't always correspond 1:1 to what you see in audit.log. if the bucket is already local, you won't see anything in audit.log.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...