Splunk Enterprise

Bucket replication to GCP cloud storage failed due to GCPCredentials - credentials not found for gcs volume error

sumanthmiddy
Loves-to-Learn

Copy of warm buckets to smartstore hosted on GCP cloud storage failling due to below error. We are using remote.gs.service_account_email setting in index.conf. 

This issue started happening after migrating to Splunk v9.0.4

ERROR ProcessTracker [43654 MainThread] - (child_150__Fsck) ProcessTracker - (subchild_43__RollFixMetadata) GCPCredentials - credentials not found for gcs volume=remote_store

Labels (1)
Tags (4)
0 Karma

vinoth_raj
Path Finder

Maybe reconfiguring the 'remote.gs.service_account_email' in indexes.conf located at $SPLUNK_HOME/etc/system/local for standalone or  $SPLUNK_HOME/etc/manager or master-apps/_cluster/local for cluster(push the replication bundle) might resolve the issue.

Note: Make sure the indexer is hosted on GCP and permissions for Splunk to access the remote store is given.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...