All Apps and Add-ons

AWS Addon for Splunk doesn't recognize config messages

jarrell
Explorer

I'm not getting anything in my config input, even though I know events are logging. I started searching _internal and found that if I watch splunk_ta_aws.modinputs.config I can see the sqs processing. WHenever a messages pops up in the queue, splunk says it's not a config record. Example:

2020-03-22 19:06:17,736 level=WARNING pid=11190 tid=MainThread logger=splunk_ta_aws.modinputs.config pos=__init__.py:_stream_events:344 | datainput="Config_0bd7b668-1857-4466-9977-1595a2745bf3" | message="Invalid notifications have been removed from SQS : {"Records":[{"eventVersion":"2.1","eventSource":"aws:s3","awsRegion":"us-east-2","eventTime":"2020-03-22T19:06:16.660Z","eventName":"ObjectCreated:Put","userIdentity":{"principalId":"AWS:XXXXXXXXXXXXXX"},"requestParameters":{"sourceIPAddress":"172.18.xx.xxx"},"responseElements":{"x-amz-request-id":"03FF16BD00681075","x-amz-id-2":"redacted"},"s3":{"s3SchemaVersion":"1.0","configurationId":"Put config notice","bucket":{"name":"correct bucket name for config data","ownerIdentity":{"principalId":"XXXXXXXXXXXXX"},"arn":"arn:aws:s3:::correct bucket name for config data"},"object":{"key":"aws-config/AWSLogs/436617320021/Config/ConfigWritabilityCheckFile","size":0,"eTag":"d41d8cd98f00b204e9800998ecf8427e","versionId":"M5RCgK646j6EJPn5MGNeMYhbzRbh8Bge","sequencer":"005E77B7289FBE2097"}}}]}"

I'm not sure how to diagnose from here!

0 Karma
1 Solution

jarrell
Explorer

Ah. the input type of "Config" expects me to subscribe it to an sqs fed by an sns that gets real time changes to the config data. What set up was an SQS based S3 bucket, which is a different option when you create it.

View solution in original post

0 Karma

jarrell
Explorer

Ah. the input type of "Config" expects me to subscribe it to an sqs fed by an sns that gets real time changes to the config data. What set up was an SQS based S3 bucket, which is a different option when you create it.

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...