About prad87

prad87

In my case the default signature_version and url_version was good enough. The problem was that the bucket had to be created in advance and the bucket had to be created with the same access key Splunk was going to be used. The problem arose from this mix up. So make sure bucket is created in advance and by the same access key.

prad87

I am trying to setup a new cluster with smartstore to an S3 compliant DELL storage and failing. The configuration is very basic as I have tried to keep every other setting to defaults. indexes.conf looks like this [volume:remote_store] storageType = remote path = s3://splunk-bucket/ remote.s3.access_key = xyzzy remote.s3.secret_key = xyzzy remote.s3.endpoint = https://internal-xyz-s3.com remote.s3.auth_region = us-east-1 [default] remotePath = volume:remote_store/$_index_name Those are the only s3 configuration. Splunk fails with the below error statusCode=403 statusDescription="Forbidden" payload="<Error><Code>SignatureDoesNotMatch</Code><Message>The request signature we calculated does not match the signature you provided. Check your Secret Access Key and signing method. For more information, see REST Authentication and SOAP Authentication for details.</Message> aws cli works from the same indexer peer and is able to connect successfully to the s3 store using same credentials. Its only when Splunk tries to use S3 it gets a 403. Version: Splunk Enterprise 9.4.6

prad87

Why is RF considered in cache sizing. I understood from this document that cache should not hold multiple copies of data. Only hot buckets would have RF. Based on that I estimate that to hold 10 TB of data for 30 days of local cache at 50% compression, I would need 5 x 30 =150 150 TB. But you have calculated it as 310 TB. Is my assumption wrong? Please note that I am not considering hot bucket storage in this calculation.

prad87 · ‎07-23-2026

Thank you @PickleRick. That makes a lot of sense, we are definitely choosing between AID-0 and JBOD. We are leaning towards AID-0 for simplicity sake with the risk of disk failure affecting the whole data mount, rather than choose JBOD with a smaller failure impact radius due to multiple disks on the same server simply because we do not know how well Splunk handles uneven fill of volumes, hotspotting or cache manager which are the challenges I read about in JBOD. Would you have any suggestions on this?

prad87 · ‎07-22-2026

@rbal_splunk So, does Splunk have a recommendation for RAID? Would Splunk suggest RAID10 if we deem redundant disks are needed. Or if the risk appetite is more, then go with JBOD if it's an indexer cluster with smartstore.

prad87 · ‎07-22-2026

Hi @masonmorales What level of IOPS do you see on your indexers? We ingest 10 TB / day and have an expansive user base. Would that be a reason to not to go with RAID5?

prad87 · ‎07-22-2026

Hi @twinspop Can you tell me your IOPS values when RAID5 was no longer good enough? I have the exact same conundrum today with our storage team recommending RAID5 as the new SSDs are very fast but I am worried about adopting RAID5 as there are multiple recommendations against it. Would a fio score of 800+ still not be strong enough rationale to go with RAID5?

Posts	7
Solutions	1
Karma Given	0
Karma Received	1
Member Since	‎07-22-2026

Online Status	Offline
Date Last Visited	a week ago

Smartstore SignatureDoesNotMatch Error

Re: Smartstore SignatureDoesNotMatch Error

Smartstore SignatureDoesNotMatch Error

Re: What are the best practices for implementing S...

Re: Storage experts: With 20 SSDs per indexer, wha...

Re: Not to use RAID5 on SSD when using SmartStor...

Re: Storage experts: With 20 SSDs per indexer, wha...

Re: Storage experts: With 20 SSDs per indexer, wha...

Join the Conversation