Knowledge Management

I have enabled smart store for my standalone indexer. When I am trying to encrypt s3 using "sse-c" , I am getting below error-


Configuration I have given in indexes.conf :

remote.s3.encryption = sse-c

remote.s3.encryption.sse-c.key_type = kms

remote.s3.encryption.sse-c.key_refresh_interval = 86400

remote.s3.kms.auth_region = us-west-2

remote.s3.kms.key_id = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"

Splunk error while restarting services:

Splunk> Australian for grep.

Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port []: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Problem parsing indexes.conf :
The following issues were found with indexes configuration:
Bad KMS key_id provided for volume=remote_store. key_id can be unique key ID or the Amazon Resource Name (ARN) of the CMK, or the alias name or ARN of an alias that points to the CMK.
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!