All Apps and Add-ons

AWS SQS Input - Unable to parse message

alonsocaio
Contributor

Hi,

I have set some SQS inputs on Splunk Add-on for AWS, but the following error is occurring:

 

2021-01-28 13:25:08,541 level=CRITICAL pid=3271 tid=Thread-2 logger=splunk_ta_aws.modinputs.sqs_based_s3.handler pos=handler.py:_process:268 | datainput="SQS_INPUT" start_time=1611850827, created=1611851108.54 message_id="MESSAGE_ID" ttl=600 job_id=JOB_ID | message="An error occurred while processing the message." 
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/handler.py", line 247, in _process
    records = self._parse(message)
  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/handler.py", line 315, in _parse
    raise ValueError("Unable to parse message.")
ValueError: Unable to parse message.

 

There are two inputs running into this issue, one is using Custom Data Type and the other one is using Cloudfront Access Logs. Also, I have some other SQS inputs that are running with no errors.

Does anyone has any hints on how to solve this "Unable to parse message" errors?

Thanks

Labels (1)
Tags (3)
0 Karma

jmatthews
Loves-to-Learn

@alonsocaio  Was anyone able to figure this out?  I'm encountering the same issue with all my SQS-based S3 inputs.  Thanks.

0 Karma

alonsocaio
Contributor

Hi @jmatthews, I have not found much information about this errors, but in my case I was able to solve it because the issue was on KMS permissions for the Splunk role I was using for reading the SQS messages / S3 objects. 

0 Karma

J_lo
Engager

I have the same issue with ELB 

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...