topic Re: "Splunk app for AWS" does not allow Cloudtrail Data Input in All Apps and Add-ons

"Splunk app for AWS" does not allow Cloudtrail Data Input

cchsiang2002 — Sun, 28 Dec 2014 07:46:57 GMT

I have configured the AWS CloudTrail with SNS and SQS.
Now I try to set up Splunk with Splunk app for AWS.

However, under "setting->Data Input", I don't see CloudTrail data input page to enter the security key, secret key, SQS Queue name, and region.
I read another similar question, and someone mentioned to update DB Connect App, but it does not help.
Could someone help to solve this problem in DETAILs...
Thanks a thousand.

Re: "Splunk app for AWS" does not allow Cloudtrail Data Input

jcoates_splunk — Sun, 28 Dec 2014 15:30:18 GMT

Hi, you need to use Splunk Add-on for Amazon Web Services to gather that data.

Re: "Splunk app for AWS" does not allow Cloudtrail Data Input

cchsiang2002 — Sun, 28 Dec 2014 16:03:31 GMT

Thanks a thousands.... It works now.

Re: "Splunk app for AWS" does not allow Cloudtrail Data Input

cchsiang2002 — Sun, 28 Dec 2014 16:45:55 GMT

Now I do see the Data Input for AWS CloudTrail, CloudWatch, AWS Billing, and S3.

However, there is no AWS accounts for me to select. There is a help text "Select an AWS account. To configure AWS accounts, go to the setup page.".

I have problem locate this "setup page".
Could someone provide step-by-step instructions to enter my AWS credential?
This shouldn't be this difficult to add my AWS credential...

Re: "Splunk app for AWS" does not allow Cloudtrail Data Input

jcoates_splunk — Sun, 28 Dec 2014 16:59:16 GMT

step by step instructions are in the documentation: http://docs.splunk.com/Documentation/AddOns/latest/AWS/Installationsteps

Re: "Splunk app for AWS" does not allow Cloudtrail Data Input

cchsiang2002 — Mon, 28 Sep 2020 18:30:12 GMT

The instruction you provided states:
"All settings can be configured through Splunk Web or manually in inputs.conf. ".
But in the document you provided, I could not find the web page description, e.g. where, and how.
As for the manual setup, I follow the instructions, and edited the following files:
$SPLUNK_HOME/etc/apps/Splunk_TA_aws/local/inputs.conf
$SPLUNK_HOME/etc/apps/Splunk_TA_aws/default/inputs.conf
Now I DO see my AWS account in the Add New Data page. When I selected my aws account that I previously specified in the "inputs.conf", I was asked for the AWS region. I selected the correct AWS region, and now I am asked for SQS queue name. But I got the following error:
"Failed to fetch data: In handler 'splunk_ta_aws_sqs_queue_names': Unexpected error "" from python handler: "No AWS Account is configured. Setup App first.". See splunkd.log for more details."
I think this is due to that I did not specify my AWS access key and secrete key.
My question...
1. Where is the Splunk Web to enter my account, access key and secrete key?
2. How do I configure access key and secrete key manually if I have to?

Re: "Splunk app for AWS" does not allow Cloudtrail Data Input

cchsiang2002 — Sun, 28 Dec 2014 17:59:17 GMT

I got it.

thanks,

Re: "Splunk app for AWS" does not allow Cloudtrail Data Input

piebob — Sun, 28 Dec 2014 18:20:43 GMT

hi. i just converted all your 'answers' into comments. in the future, please don't use the 'answer' field to ask questions or comment.

Re: "Splunk app for AWS" does not allow Cloudtrail Data Input

clifforg — Mon, 28 Sep 2020 19:28:27 GMT

I am getting the same problem. I tried using a root access key just to confirm its not permissions

Failed to fetch data: In handler 'splunk_ta_aws_sqs_queue_names': Unexpected error "" from python handler: "'error' object has no attribute 'status'". See splunkd.log for more details.

Any advise?

Re: "Splunk app for AWS" does not allow Cloudtrail Data Input

jcoates_splunk — Tue, 14 Apr 2015 17:05:27 GMT

I would turn on DEBUG logging

Re: "Splunk app for AWS" does not allow Cloudtrail Data Input

clifforg — Mon, 28 Sep 2020 19:28:32 GMT

Doesn't appear to be that great - from splunkd.log

04-14-2015 13:21:12.643 -0400 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 70, in init\n hand.execute(info)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 527, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws_sqs_queue_names_handler.py", line 26, in wrapper\n result = func(*args, **kwargs)\n File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws_sqs_queue_names_handler.py", line 73, in handleList\n type(e).name, e.status, e.reason, e.error_code, e.error_message))\nAttributeError: 'error' object has no attribute 'status'\n
04-14-2015 13:21:12.643 -0400 ERROR AdminManagerExternal - Unexpected error "" from python handler: "'error' object has no attribute 'status'". See splunkd.log for more details.

Re: "Splunk app for AWS" does not allow Cloudtrail Data Input

jcoates_splunk — Tue, 14 Apr 2015 18:05:21 GMT

I suspect that you've turned on Splunk Enterprise debug or something? I was actually referring to the Add-ons' debug logging, accessed via Manage Apps -> setup. The general troubleshooting section for Add-ons goes over what to look for: http://docs.splunk.com/Documentation/AddOns/released/Overview/Troubleshootadd-ons

Re: "Splunk app for AWS" does not allow Cloudtrail Data Input

clifforg — Tue, 14 Apr 2015 18:25:16 GMT

I did it through the Apps-->Setup - but I was still looking in the splunkd.log for the information.

I ran the query per the link you sent

index = _internal source=aws

and I see DEBUG entries - but not errors.