topic Re: Bucket replication to GCP cloud storage failed due to GCPCredentials - credentials not found for gcs volume error in Splunk Enterprise

Bucket replication to GCP cloud storage failed due to GCPCredentials - credentials not found for gcs volume error

sumanthmiddy — Sat, 29 Apr 2023 08:12:23 GMT

Copy of warm buckets to smartstore hosted on GCP cloud storage failling due to below error. We are using remote.gs.service_account_email setting in index.conf.

This issue started happening after migrating to Splunk v9.0.4

ERROR ProcessTracker [43654 MainThread] - (child_150__Fsck) ProcessTracker - (subchild_43__RollFixMetadata) GCPCredentials - credentials not found for gcs volume=remote_store

Re: Bucket replication to GCP cloud storage failed due to GCPCredentials - credentials not found for gcs volume error

vinoth_raj — Mon, 01 May 2023 07:04:58 GMT

Maybe reconfiguring the 'remote.gs.service_account_email' in indexes.conf located at $SPLUNK_HOME/etc/system/local for standalone or $SPLUNK_HOME/etc/manager or master-apps/_cluster/local for cluster(push the replication bundle) might resolve the issue.

Note: Make sure the indexer is hosted on GCP and permissions for Splunk to access the remote store is given.