All Apps and Add-ons

Splunk Add-On for Google Cloud Platform: Splunk Add-on REST Handler ERROR[1021]: Fail to decrypt the encrypted credential information - Failed to get credentials

efferth
Path Finder

Splunk Add-on REST Handler ERROR[1021]: Fail to decrypt the encrypted credential information - Failed to get credentials

The JSON object that I am getting from my Google Service account appears to not be working correctly. Does anyone else have this issue or know how to solve it?

{
  "type": "service_account",
  "project_id": "<MY SPLUNK PROJECT>",
  "private_key_id": "<MY PK ID>",
  "private_key": "-----BEGIN PRIVATE KEY-----\<MY PRIVATE KEY>\n-----END PRIVATE KEY-----\n",
  "client_email": "<splunk>@<splunk>-splunk-project.iam.gserviceaccount.com",
  "client_id": "<MY CLIENT ID>",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://accounts.google.com/o/oauth2/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/<MY-SPLUNK-URL>"
}
1 Solution

efferth
Path Finder

Figured it out a long time ago but answering now to close the question.

Make sure to install this app as the admin user.

View solution in original post

efferth
Path Finder

Figured it out a long time ago but answering now to close the question.

Make sure to install this app as the admin user.

AzmathShaik
Path Finder

Have you found the solution to the above error mentioned???

0 Karma

efferth
Path Finder

Sadly, no. The project spans a few different teams so the timing of everything is slowed down. I tried a newly generated json object and still got the same error. Is there a specific configuration within the google service account that needs to be in place? (I am only dealing with the splunk side of things in this case)

0 Karma

AzmathShaik
Path Finder

may i know, on which you are trying to install the Application (Splunk Add-On for Google Cloud Platform)??
i mean whether on search head or indexer

0 Karma

efferth
Path Finder

I am installing it on the searchhead.

0 Karma

AzmathShaik
Path Finder

i hope you are facing the problem with the json code. previously i installed it on IDX and now i verified it on SH also i works fine for me

0 Karma

efferth
Path Finder

I have located the error. The user permissions on the Splunk side were not sufficient to run the program.

Future viewers of this thread: Hello! and make sure you have admin permissions when trying to run this Add-on.

0 Karma

AzmathShaik
Path Finder

Sorry i forgot to mention it exactly as you mention you have to install the app as a admin user.
may i know as which user you were trying to do it??

efferth
Path Finder

It was as a power user

0 Karma

AzmathShaik
Path Finder

if possible verify the below parameters
1)client_email":
2)client_x509_cert_url":

the above both should look same(almost)

0 Karma

efferth
Path Finder

I looked at the JSON object and the values in these fields are nearly identical. The only difference being the "@" from client_email is replaced by "%40" in client_x509_cert_url

0 Karma

AzmathShaik
Path Finder

yeah exactly the same difference i had and i worked fine for me

if possible try to generate the json object once again for the project

0 Karma

AzmathShaik
Path Finder

Hello
can you post the steps that you have followed??

i have done it but i didn't faced any problem

0 Karma

efferth
Path Finder

I followed the steps from this link: https://splunkbase.splunk.com/app/3088/#/documentation

My problem occurs at point "Configure the Splunk Add-on for Google Cloud Platform" 1e

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...