Edge Processor Error while putting object in S3 Bucket: GET request failed: 401 Unauthorized

Applicability

Description

Edge Processor is encountering persistent 401 Unauthorized errors during data export operations to S3 Buckets. This error signifies a failure in authentication or authorisation when the Edge Processor attempts to perform PUT requests against the configured S3 target. The observed symptom is continuous logging of Exporting failed. Will retry the request after interval.

{
error: error while putting object in S3 Bucket: GET request failed: 401 Unauthorized
interval: 40.128448613s
level: INFO
location: internal/retry_sender.go:126
message: Exporting failed. Will retry the request after interval.
time: 2025-10-07T08:11:31.549Z
}

Investigation

Despite the appearance of a 401 Unauthorized error and the associated "Exporting failed. Will retry the request after interval." messages, internal analysis has determined that this specific error sequence does not impact the core functionality or data processing capabilities of the Edge Processor. 

Resolution

The 401 Unauthorized error observed in Edge Processor logs, specifically related to S3 export attempts, is benign and does not negatively affect the core functionality or stability of Splunk environment. This error occurs during a process designed to backport edge.log files to a designated Splunk AWS S3 bucket.

The Edge Processor attempts to validate its authentication and the existence of the target S3 bucket by issuing a GET request. However, the configured permissions for the Edge Processor's interaction with the Splunk AWS S3 bucket are intentionally restricted to PUT operations only, allowing it to successfully push logs without granting broader GET access. Consequently, the GET request for authentication and bucket existence check fails with a 401 Unauthorized error. Despite this logged error, the subsequent PUT operations to push the edge.log data to the S3 bucket via the signed endpoint provided by a Splunk service proceed successfully.

Therefore, this specific 401 Unauthorized log entry is informational only and does not indicate a functional problem with data export or the Edge Processor's performance. No action is required to address this message.