topic Re: AWS SQS Input - Unable to parse message in All Apps and Add-ons

AWS SQS Input - Unable to parse message

alonsocaio — Thu, 28 Jan 2021 16:43:38 GMT

Hi,

I have set some SQS inputs on Splunk Add-on for AWS, but the following error is occurring:

2021-01-28 13:25:08,541 level=CRITICAL pid=3271 tid=Thread-2 logger=splunk_ta_aws.modinputs.sqs_based_s3.handler pos=handler.py:_process:268 | datainput="SQS_INPUT" start_time=1611850827, created=1611851108.54 message_id="MESSAGE_ID" ttl=600 job_id=JOB_ID | message="An error occurred while processing the message." Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/handler.py", line 247, in _process records = self._parse(message) File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/handler.py", line 315, in _parse raise ValueError("Unable to parse message.") ValueError: Unable to parse message.

There are two inputs running into this issue, one is using Custom Data Type and the other one is using Cloudfront Access Logs. Also, I have some other SQS inputs that are running with no errors.

Does anyone has any hints on how to solve this "Unable to parse message" errors?

Thanks

Re: AWS SQS Input - Unable to parse message

J_lo — Thu, 08 Apr 2021 16:43:38 GMT

I have the same issue with ELB

Re: AWS SQS Input - Unable to parse message

jmatthews — Thu, 24 Jun 2021 22:05:17 GMT

@alonsocaio Was anyone able to figure this out? I'm encountering the same issue with all my SQS-based S3 inputs. Thanks.

Re: AWS SQS Input - Unable to parse message

alonsocaio — Fri, 25 Jun 2021 11:23:28 GMT

Hi @jmatthews, I have not found much information about this errors, but in my case I was able to solve it because the issue was on KMS permissions for the Splunk role I was using for reading the SQS messages / S3 objects.