All Apps and Add-ons

AWS SQS Input - Unable to parse message



I have set some SQS inputs on Splunk Add-on for AWS, but the following error is occurring:


2021-01-28 13:25:08,541 level=CRITICAL pid=3271 tid=Thread-2 logger=splunk_ta_aws.modinputs.sqs_based_s3.handler | datainput="SQS_INPUT" start_time=1611850827, created=1611851108.54 message_id="MESSAGE_ID" ttl=600 job_id=JOB_ID | message="An error occurred while processing the message." 
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/", line 247, in _process
    records = self._parse(message)
  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/", line 315, in _parse
    raise ValueError("Unable to parse message.")
ValueError: Unable to parse message.


There are two inputs running into this issue, one is using Custom Data Type and the other one is using Cloudfront Access Logs. Also, I have some other SQS inputs that are running with no errors.

Does anyone has any hints on how to solve this "Unable to parse message" errors?


Labels (1)
Tags (3)
0 Karma


@alonsocaio  Was anyone able to figure this out?  I'm encountering the same issue with all my SQS-based S3 inputs.  Thanks.

0 Karma


Hi @jmatthews, I have not found much information about this errors, but in my case I was able to solve it because the issue was on KMS permissions for the Splunk role I was using for reading the SQS messages / S3 objects. 

0 Karma


I have the same issue with ELB 

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...