All Apps and Add-ons

AWS SQS Input - Unable to parse message

alonsocaio
Contributor

Hi,

I have set some SQS inputs on Splunk Add-on for AWS, but the following error is occurring:

 

2021-01-28 13:25:08,541 level=CRITICAL pid=3271 tid=Thread-2 logger=splunk_ta_aws.modinputs.sqs_based_s3.handler pos=handler.py:_process:268 | datainput="SQS_INPUT" start_time=1611850827, created=1611851108.54 message_id="MESSAGE_ID" ttl=600 job_id=JOB_ID | message="An error occurred while processing the message." 
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/handler.py", line 247, in _process
    records = self._parse(message)
  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/handler.py", line 315, in _parse
    raise ValueError("Unable to parse message.")
ValueError: Unable to parse message.

 

There are two inputs running into this issue, one is using Custom Data Type and the other one is using Cloudfront Access Logs. Also, I have some other SQS inputs that are running with no errors.

Does anyone has any hints on how to solve this "Unable to parse message" errors?

Thanks

Labels (1)
Tags (3)
0 Karma

J_lo
Engager

I have the same issue with ELB 

0 Karma