All Apps and Add-ons

AWS SQS Input - Unable to parse message



I have set some SQS inputs on Splunk Add-on for AWS, but the following error is occurring:


2021-01-28 13:25:08,541 level=CRITICAL pid=3271 tid=Thread-2 logger=splunk_ta_aws.modinputs.sqs_based_s3.handler | datainput="SQS_INPUT" start_time=1611850827, created=1611851108.54 message_id="MESSAGE_ID" ttl=600 job_id=JOB_ID | message="An error occurred while processing the message." 
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/", line 247, in _process
    records = self._parse(message)
  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/", line 315, in _parse
    raise ValueError("Unable to parse message.")
ValueError: Unable to parse message.


There are two inputs running into this issue, one is using Custom Data Type and the other one is using Cloudfront Access Logs. Also, I have some other SQS inputs that are running with no errors.

Does anyone has any hints on how to solve this "Unable to parse message" errors?


Labels (1)
Tags (3)
0 Karma


@alonsocaio  Was anyone able to figure this out?  I'm encountering the same issue with all my SQS-based S3 inputs.  Thanks.

0 Karma


Hi @jmatthews, I have not found much information about this errors, but in my case I was able to solve it because the issue was on KMS permissions for the Splunk role I was using for reading the SQS messages / S3 objects. 

0 Karma


I have the same issue with ELB 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...