Splunk Enterprise

Bucket replication to GCP cloud storage failed due to GCPCredentials - credentials not found for gcs volume error

sumanthmiddy
Loves-to-Learn

Copy of warm buckets to smartstore hosted on GCP cloud storage failling due to below error. We are using remote.gs.service_account_email setting in index.conf. 

This issue started happening after migrating to Splunk v9.0.4

ERROR ProcessTracker [43654 MainThread] - (child_150__Fsck) ProcessTracker - (subchild_43__RollFixMetadata) GCPCredentials - credentials not found for gcs volume=remote_store

Labels (1)
Tags (4)
0 Karma

vinoth_raj
Path Finder

Maybe reconfiguring the 'remote.gs.service_account_email' in indexes.conf located at $SPLUNK_HOME/etc/system/local for standalone or  $SPLUNK_HOME/etc/manager or master-apps/_cluster/local for cluster(push the replication bundle) might resolve the issue.

Note: Make sure the indexer is hosted on GCP and permissions for Splunk to access the remote store is given.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...