Splunk Enterprise

Bucket replication to GCP cloud storage failed due to GCPCredentials - credentials not found for gcs volume error

sumanthmiddy
Loves-to-Learn

Copy of warm buckets to smartstore hosted on GCP cloud storage failling due to below error. We are using remote.gs.service_account_email setting in index.conf. 

This issue started happening after migrating to Splunk v9.0.4

ERROR ProcessTracker [43654 MainThread] - (child_150__Fsck) ProcessTracker - (subchild_43__RollFixMetadata) GCPCredentials - credentials not found for gcs volume=remote_store

Labels (1)
Tags (4)
0 Karma

vinoth_raj
Path Finder

Maybe reconfiguring the 'remote.gs.service_account_email' in indexes.conf located at $SPLUNK_HOME/etc/system/local for standalone or  $SPLUNK_HOME/etc/manager or master-apps/_cluster/local for cluster(push the replication bundle) might resolve the issue.

Note: Make sure the indexer is hosted on GCP and permissions for Splunk to access the remote store is given.

0 Karma
Get Updates on the Splunk Community!

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...