Knowledge Management

I have enabled smart store for my standalone indexer. When I am trying to encrypt s3 using "sse-c" , I am getting below error-


Configuration I have given in indexes.conf :

remote.s3.encryption = sse-c

remote.s3.encryption.sse-c.key_type = kms

remote.s3.encryption.sse-c.key_refresh_interval = 86400

remote.s3.kms.auth_region = us-west-2

remote.s3.kms.key_id = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"

Splunk error while restarting services:

Splunk> Australian for grep.

Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port []: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Problem parsing indexes.conf :
The following issues were found with indexes configuration:
Bad KMS key_id provided for volume=remote_store. key_id can be unique key ID or the Amazon Resource Name (ARN) of the CMK, or the alias name or ARN of an alias that points to the CMK.
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at

Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...