topic Re: KeyError: 'LaunchConfigurationName' in Splunk App for AWS in All Apps and Add-ons

KeyError: 'LaunchConfigurationName' in Splunk App for AWS

cemeyer2 — Mon, 18 Feb 2019 15:53:14 GMT

I am seeing thousands of errors in my splunk logs from the App for AWS in the form:

2019-02-18 15:46:34,156 level=ERROR pid=26588 tid=MainThread logger=splunk_ta_aws.modinputs.cloudwatch.handler pos=utils.py:wrapper:71 | start_time=1550504529.1, iam_role="" region="========" account="==========", datainput="cloudwatch_===========" region="us-east-1" | message="Task was interrupted by an unhandled exception." 
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunksdc/utils.py", line 69, in wrapper
    return func(*args, **kwargs)
  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/cloudwatch/handler.py", line 121, in run
    metrics = self._load_metrics(checkpoint, client)
  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/cloudwatch/handler.py", line 128, in _load_metrics
    metrics = self._discover(client)
  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/cloudwatch/handler.py", line 160, in _discover
    for metrics in self._discovery(client):
  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/cloudwatch/discovery/ec2.py", line 121, in __call__
    lcn = group['LaunchConfigurationName']
KeyError: 'LaunchConfigurationName'

It seems like this might be what is causing my ec2 insights page to not display any data. Is there some configuration I missed when setting up the add on?

Re: KeyError: 'LaunchConfigurationName' in Splunk App for AWS

Vijeta — Mon, 18 Feb 2019 17:30:34 GMT

Did any of the configs for AWS TA changed, like any of the API keys. Check if all the keys are same in AWS for your inputs in Splunk AWS add-on.The message in your first line is "Task was interrupted by an unhandled exception". This message seems to be for cloudwatch input, see if something changed.

Re: KeyError: 'LaunchConfigurationName' in Splunk App for AWS

cemeyer2 — Mon, 18 Feb 2019 17:44:34 GMT

nothing should have changed, been seeing this error since I configured the addon

Re: KeyError: 'LaunchConfigurationName' in Splunk App for AWS

Vijeta — Mon, 18 Feb 2019 17:47:35 GMT

Did you restart after doing the config. I was getting error from python script regarding authentication and for me restarting the Heavy forwarder where my add-on was configured resolved the issue.

Re: KeyError: 'LaunchConfigurationName' in Splunk App for AWS

cemeyer2 — Mon, 18 Feb 2019 17:49:19 GMT

yep, its been restarted several times

Re: KeyError: 'LaunchConfigurationName' in Splunk App for AWS

adityapavan27 — Mon, 27 Jan 2020 21:34:58 GMT

@cemeyer2 : Any luck resolving this?

Re: KeyError: 'LaunchConfigurationName' in Splunk App for AWS

brt — Wed, 01 Apr 2020 03:48:00 GMT

Did you ever get this resolved?
I'm getting the same exact error on a brand new Splunk AWS add-on installation (I have restarted it since the install).

Re: KeyError: 'LaunchConfigurationName' in Splunk App for AWS

ngohel — Wed, 27 Jan 2021 01:58:45 GMT

I have had the same error. I was able to eliminate that error by updating the ec2.py script as suggested by Splunk Support Team.

Update from Splunk Support:

Please try the following workaround

Open %SPLUNK_HOME/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/cloudwatch/discovery/ec2.py
Find the following lines, those lines should be located at line 120 to line 123

for group in auto_scaling_groups:

lcn = group['LaunchConfigurationName']

typename = configurations[lcn]

metric_names = self._create_metric_names(typename)

Remove line 121 and hardcode the typename, it should looks like the following text after editing

for group in auto_scaling_groups:

typename = 'c5'

metric_names = self._create_metric_names(typename)

using your corresponding instance type.

There is a known limitation of AWS Launch template instance type detection.