Smartstore SignatureDoesNotMatch Error

[prad87]

I am trying to setup a new cluster with smartstore to an S3 compliant DELL storage and failing. The configuration is very basic as I have tried to keep every other setting to defaults.

indexes.conf looks like this

[volume:remote_store]
storageType = remote
path = s3://splunk-bucket/
remote.s3.access_key = xyzzy
remote.s3.secret_key = xyzzy
remote.s3.endpoint = https://internal-xyz-s3.com
remote.s3.auth_region = us-east-1

[default]
remotePath = volume:remote_store/$_index_name

Those are the only s3 configuration. Splunk fails with the below error

statusCode=403 statusDescription="Forbidden" payload="<Error><Code>SignatureDoesNotMatch</Code><Message>The request signature we calculated does not match the signature you provided. Check your Secret Access Key and signing method. For more information, see REST Authentication and SOAP Authentication for details.</Message>

aws cli works from the same indexer peer and is able to connect successfully to the s3 store using same credentials. Its only when Splunk tries to use S3 it gets a 403.

Version: Splunk Enterprise 9.4.6

[prad87 · Accepted solution]

In my case the default signature_version and url_version was good enough. The problem was that the bucket had to be created in advance and the bucket had to be created with the same access key Splunk was going to be used. The problem arose from this mix up. So make sure bucket is created in advance and by the same access key.

[livehybrid]

Hi @prad87 

The SignatureDoesNotMatch error with Dell S3-compatible storage could be due to the configuraiton/support of signature versions in the Dell System, I would suggest try setting Splunk to use v2 instead of the default v4 signature.

Add the following to your indexes.conf:

[volume:remote_store] 
remote.s3.signature_version = v2
remote.s3.url_version = v1

The url_version = v1 setting must be set when signature_version = v2 

Once done restart Splunk.

For more info check out indexes.conf - remote.s3.signature_version

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.