topic Re: SmartStore with HCP - delete fails in Splunk Enterprise

SmartStore with HCP - why does delete fail?

lmichalski_2 — Fri, 19 Aug 2022 14:39:12 GMT

Hi,

Did anyone succeeded with configuring Splunk with HCP?
CacheManager is able to upload and download buckets - it works perfectly.

But every time Splunk tries to freeze bucket, transaction fails with error 501 (not implemented).
The same if I try to do it from splunk CLI to manually remove bucket/file.

WARN S3Client - command=remove transactionId=0x7fb4332dXXXX rTxnId=0x7fb427bfXXXX status=completed success=N uri=https://splunk.XXXXXXXXXXX.com.pl/buckets/test/db/d7/cd/66~7FD81528-13C4-4063-A45C-26DE9D698D42/receipt.json statusCode=501 statusDescription="Not Implemented" payload="<?xml version='1.0' encoding='UTF-8'?>\n<Error>\n <Code>NotImplemented</Code>\n <Message>Only the current version of an object can be deleted.</Message>\n <RequestId>160104XXXXX31</RequestId>\n <HostId>aGNwLXIuYmXXXXXXXXXXXXXMTA4</HostId>\n</Error>\n\n"

We tried to disable and enable versioning on HCP, does not help.

Had anyone such issue? What additional is needed to configure on HCP or Splunk.

Re: SmartStore with HCP - delete fails

Nisha18789 — Tue, 26 Oct 2021 16:14:07 GMT

hello @lmichalski_2 , could you please advise if you were able to make the delete work? We are facing exactly the same problem. Any help is much appreciated.

Re: SmartStore with HCP - delete fails

lmichalski_2 — Tue, 26 Oct 2021 16:23:42 GMT

Hello!

Please add

remote.s3.supports_versioning = false

to server.conf and restart Splunk.

You can disable versioning on HCP only if you have 1 standalone indexer.
In distributed environment do not disable versioning on HCP!

Re: SmartStore with HCP - delete fails

Nisha18789 — Fri, 19 Aug 2022 10:17:17 GMT

thanks @lmichalski_2 , we actually have a distributed environment, so in case case shall we add

remote.s3.supports_versioning = true

in server.conf and restart?

Re: SmartStore with HCP - delete fails

lmichalski_2 — Mon, 22 Aug 2022 13:47:25 GMT

Yes, push it from Cluster Master (or eventually: put on every search peer in system/local/server.conf).

Do not try to disable versioning on HCP.