Splunk Enterprise

SmartStore with HCP - why does delete fail?

lmichalski_2
Explorer

Hi,

Did anyone succeeded with configuring Splunk with HCP?
CacheManager is able to upload and download buckets - it works perfectly.

 

But every time Splunk tries to freeze bucket, transaction fails with error 501 (not implemented).
The same if I try to do it from splunk CLI to manually remove bucket/file.

WARN S3Client - command=remove transactionId=0x7fb4332dXXXX rTxnId=0x7fb427bfXXXX status=completed success=N uri=https://splunk.XXXXXXXXXXX.com.pl/buckets/test/db/d7/cd/66~7FD81528-13C4-4063-A45C-26DE9D698D42/rece... statusCode=501 statusDescription="Not Implemented" payload="<?xml version='1.0' encoding='UTF-8'?>\n<Error>\n <Code>NotImplemented</Code>\n <Message>Only the current version of an object can be deleted.</Message>\n <RequestId>160104XXXXX31</RequestId>\n <HostId>aGNwLXIuYmXXXXXXXXXXXXXMTA4</HostId>\n</Error>\n\n"

We tried to disable and enable versioning on HCP, does not help.

Had anyone such issue? What additional is needed to configure on HCP or Splunk.

Labels (1)
0 Karma

Nisha18789
Builder

hello @lmichalski_2 , could you please advise if you were able to make the delete work? We are facing exactly the same problem. Any help is much appreciated.

Tags (1)
0 Karma

lmichalski_2
Explorer

Hello!

Please add 

remote.s3.supports_versioning = false

to server.conf and restart Splunk.

You can disable versioning on HCP only if you have 1 standalone indexer.
In distributed environment do not disable versioning on HCP!

Nisha18789
Builder

thanks @lmichalski_2 , we actually have a distributed environment, so in case case shall we add 

remote.s3.supports_versioning = true

in server.conf and restart? 

0 Karma

lmichalski_2
Explorer

Yes, push it from Cluster Master (or eventually: put on every search peer in system/local/server.conf).

Do not try to disable versioning on HCP.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...