Did anyone succeeded with configuring Splunk with HCP?
CacheManager is able to upload and download buckets - it works perfectly.
But every time Splunk tries to freeze bucket, transaction fails with error 501 (not implemented).
The same if I try to do it from splunk CLI to manually remove bucket/file.
WARN S3Client - command=remove transactionId=0x7fb4332dXXXX rTxnId=0x7fb427bfXXXX status=completed success=N uri=https://splunk.XXXXXXXXXXX.com.pl/buckets/test/db/d7/cd/66~7FD81528-13C4-4063-A45C-26DE9D698D42/rece... statusCode=501 statusDescription="Not Implemented" payload="<?xml version='1.0' encoding='UTF-8'?>\n<Error>\n <Code>NotImplemented</Code>\n <Message>Only the current version of an object can be deleted.</Message>\n <RequestId>160104XXXXX31</RequestId>\n <HostId>aGNwLXIuYmXXXXXXXXXXXXXMTA4</HostId>\n</Error>\n\n"
We tried to disable and enable versioning on HCP, does not help.
Had anyone such issue? What additional is needed to configure on HCP or Splunk.
remote.s3.supports_versioning = false
to server.conf and restart Splunk.
You can disable versioning on HCP only if you have 1 standalone indexer.
In distributed environment do not disable versioning on HCP!