topic Re: Splunk for Cloudwatch in Splunk Dev

Splunk for Cloudwatch

michaeloleary — Mon, 28 Sep 2020 14:34:32 GMT

Hi Folks,

I was wondering if you ladies/gents could help me. I'm trying to integrate Splunk for Cloudwatch to pick up message that are in an SQS. I have created and SNS and test alarms and I can see these passing the the SQS.

I have also created and AWS secret key and an access key to query the cloudwatch and edited this in the aws_sqs.py

access_key = 'blah'
secret_key = 'blah'
queue_name = 'splunk_cloudwatch_test_sqs'

Unfortunately I'm getting an error when I'm attempting to poll the SQS as seen in the output below.

[*************** bin]# ./aws_sqs.py
Traceback (most recent call last):
File "./aws_sqs.py", line 45, in
q.set_message_class(RawMessage)
AttributeError: 'NoneType' object has no attribute 'set_message_class'
[*************** bin]#

Could anyone point me in the right direction as to what I'm missing that could be causing this issue?

Regards
Michael

Re: Splunk for Cloudwatch

walmc — Thu, 15 Aug 2013 03:07:05 GMT

Hi,

Looks like you are trying to call set_message_class on a 'NoneType' .. so my bet is that what was returned from sqs.get_queue(queue_name) was None .. i.e you dont have a SQS queue with that name set up in your account.

Wal

Re: Splunk for Cloudwatch

michaeloleary — Mon, 28 Sep 2020 14:35:09 GMT

Actually it was just a problem with the version of python-boto that was installed on the system. Version 2.5 of python-boto was installed by upgrading to python-boto 2.10 the issue was solved and now I can see all regions. Just something to watch out for if you guys are doing any work with AWS in the future. I also explicitly told the script to connect to the APAC southeast 2 region using the boto.sqs.connect_to_region() object found in the docs below.

Docs:
http://boto.readthedocs.org/en/latest/sqs_tut.html

[RegionInfo:us-east-1, RegionInfo:eu-west-1, RegionInfo:us-west-1, RegionInfo:us-west-2, RegionInfo:sa-east-1, RegionInfo:ap-northeast-1, RegionInfo:ap-southeast-1, RegionInfo:ap-southeast-2]
2.10.0
[Queue(https://ap-southeast-2.queue.amazonaws.com//splunk_test_queue_ap_southeast_2)]

Re: Splunk for Cloudwatch

michaeloleary — Thu, 15 Aug 2013 23:52:57 GMT

The queue was setup but because python-boto 2.5 was unable to see the ap-southeast-2 region It was returning None instead of the queue that I created. Cheers Walmc for the information, I'm not really a python programmer so the info you gave me got me started on the right track.