Error on creating a PubSub input from a service-account in the Google Cloud Platform Addon

[dcgen17]

Hello, 

From my client I created a service-account in the Google Cloud Platform: 

{
  "type": "service_account",
  "project_id": "<MY SPLUNK PROJECT>",
  "private_key_id": "<MY PK ID>",
  "private_key": "-----BEGIN PRIVATE KEY-----\<MY PRIVATE KEY>\n-----END PRIVATE KEY-----\n",
  "client_email": "<splunk>@<splunk>-<blabla>,
  "client_id": "<MY CLIENT ID>",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://accounts.google.com/o/oauth2/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/<MY-SPLUNK-URL>"
}

The service-account was recognized by the Addon so I imagined that the connection was established correctly. 

When later I created the first input to collect the logs (a PubSub), when I am searching for the "Projects" connected to this service-account (in the photo)

it returns me the error "External handler failed with code '1' and output ''. see splunkd.log for stderr"

Actually the stderr in splunkd gives no useful information (just a generic error), so I am blocked at the moment.
I also downloaded the code from Google Cloud Platform Add-on but it is not an easy debugging process, I cannot find what is the actual query that the Addon performs when clicking on "Projects". 

Someone have some idea on this error? 

Thanks

[Meett]

Hey @dcgen17 What do you see in Splunkd Logs ? 

[dcgen17 · Accepted solution]

Hello @Meett 

In the splunkd I see a copy of the error "External handler failed with code '1' and output ''.  without any specific additional information. 

Luckily I solve the issue for this case:

It was not an Addon problem but a Google Cloud permission issue. In fact, I did not have the Viewer permission for the Projects to execute correctly the queries from Splunk. 

A very simple case, complicated by the fact that the Addon returns no details about the error.

Bye, thanks