All Apps and Add-ons
Highlighted

Can you help me with the following authentication error with AWS Trusted Advisor Plugin (Splunk Enterprise 7.1.3)?

Explorer

I'm running into an authentication issue right after I add a new input to the plugin (see below).

Running Enterprise 7.1.3 on RHEL 7.5

Steps - Install the plugin via GUI, restart Splunk via GUI, disable the default inputs (8x nhsd*), and add a new input. I've tried using an Access&Secret key, an assume role ARN and a IAM role for the instance — all generate the same error (see above).

(Error message from splunkd.log)

*10-02-2018 00:00:00.001 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/aws_trusted_advisor.py" Traceback (most recent call last):
10-02-2018 00:00:00.001 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/aws_trusted_advisor.py"   File "/opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/ta_aws_trusted_advisor/modinput_wrapper/base_modinput.py", line 127, in stream_events
10-02-2018 00:00:00.001 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/aws_trusted_advisor.py"     self.collect_events(ew)
10-02-2018 00:00:00.001 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/aws_trusted_advisor.py"   File "/opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/aws_trusted_advisor.py", line 72, in collect_events
10-02-2018 00:00:00.001 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/aws_trusted_advisor.py"     input_module.collect_events(self, ew)
10-02-2018 00:00:00.001 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/aws_trusted_advisor.py"   File "/opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/input_module_aws_trusted_advisor.py", line 267, in collect_events
10-02-2018 00:00:00.001 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/aws_trusted_advisor.py"     client = authenticate(helper)
10-02-2018 00:00:00.001 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/aws_trusted_advisor.py"   File "/opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/input_module_aws_trusted_advisor.py", line 119, in authenticate
10-02-2018 00:00:00.001 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/aws_trusted_advisor.py"     aws_access_key_id=access_key_id,
10-02-2018 00:00:00.001 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/aws_trusted_advisor.py" UnboundLocalError: local variable 'access_key_id' referenced before assignment
10-02-2018 00:00:00.001 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/aws_trusted_advisor.py" ERRORlocal variable 'access_key_id' referenced before assignment*

Any thoughts? Thanks in advance

0 Karma
Highlighted

Re: Can you help me with the following authentication error with AWS Trusted Advisor Plugin (Splunk Enterprise 7.1.3)?

Contributor

Hi,
I’ll look into this and get back to you tomorrow (currently at Splunk Conf!)
I’ll also remove the default inputs from the next version of the app.
Thanks
Will (Author)

0 Karma
Highlighted

Re: Can you help me with the following authentication error with AWS Trusted Advisor Plugin (Splunk Enterprise 7.1.3)?

Contributor

Sorry about the delay getting back to you on this.
Looks like a typo that I missed. Can you try replacing your file:
/opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/inputmoduleawstrustedadvisor.py
with this: https://pastebin.com/UheNeDDz
Give it a restart/toggle on/off and see if it works? Let me know how it goes so I can update the app on Splunkbase!
Thanks
Will

0 Karma
Highlighted

Re: Can you help me with the following authentication error with AWS Trusted Advisor Plugin (Splunk Enterprise 7.1.3)?

Explorer

Will -

The proposed code worked as I am past that error, but I'm encountering two new issues (they are probably related). I was getting a truncate length error, but I was able to resolve this by mod'ing the plugin props.conf file (TRUNCATE = 175000). The plugin now pulls data for the first input (I had to mod the dashboard templates because of index naming, but this is a non-issue).

When I attempt to add a 2nd or 3rd input, I get the following errors in the log -

2018-10-08 19:30:34,728 WARNING pid=81170 tid=MainThread file=base_modinput.py:log_warning:300 | scrub_INPUT-NAME-HERE
2018-10-08 19:50:34,683 WARNING pid=92805 tid=MainThread file=base_modinput.py:log_warning:300 | scrub_INPUT-NAME-HERE
2018-10-08 20:10:34,947 WARNING pid=106592 tid=MainThread file=base_modinput.py:log_warning:300 | scrub_INPUT-NAME-HERE
2018-10-08 20:30:34,634 WARNING pid=119048 tid=MainThread file=base_modinput.py:log_warning:300 | scrub_INPUT-NAME-HERE
2018-10-08 20:50:34,668 WARNING pid=571 tid=MainThread file=base_modinput.py:log_warning:300 | scrub_INPUT-NAME-HERE
2018-10-08 21:10:34,777 WARNING pid=13451 tid=MainThread file=base_modinput.py:log_warning:300 | scrub_INPUT-NAME-HERE
2018-10-08 21:30:34,792 WARNING pid=26452 tid=MainThread file=base_modinput.py:log_warning:300 | scrub_INPUT-NAME-HERE
2018-10-08 21:50:34,671 WARNING pid=39096 tid=MainThread file=base_modinput.py:log_warning:300 | scrub_INPUT-NAME-HERE
2018-10-08 22:10:34,920 WARNING pid=52040 tid=MainThread file=base_modinput.py:log_warning:300 | scrub_INPUT-NAME-HERE
2018-10-08 22:30:34,925 WARNING pid=64241 tid=MainThread file=base_modinput.py:log_warning:300 | scrub_INPUT-NAME-HERE
2018-10-08 22:50:34,833 WARNING pid=76296 tid=MainThread file=base_modinput.py:log_warning:300 | scrub_INPUT-NAME-HERE
2018-10-08 23:10:47,972 WARNING pid=90005 tid=MainThread file=base_modinput.py:log_warning:300 | scrub_INPUT-NAME-HERE
2018-10-08 23:30:39,522 WARNING pid=102299 tid=MainThread file=base_modinput.py:log_warning:300 | scrub_INPUT-NAME-HERE
2018-10-08 23:50:49,920 WARNING pid=115220 tid=MainThread file=base_modinput.py:log_warning:300 | scrub_INPUT-NAME-HERE

I've swapped the plugin log mode to 'debug' to see if there is any more information to glean; any thoughts?

Thanks,
-Adam

0 Karma
Highlighted

Re: Can you help me with the following authentication error with AWS Trusted Advisor Plugin (Splunk Enterprise 7.1.3)?

Contributor

Apologies in the delay getting back to you on this...did you manage to get this working? I havent been able to replicate the above error...
Thanks
Will

0 Karma
Highlighted

Re: Can you help me with the following authentication error with AWS Trusted Advisor Plugin (Splunk Enterprise 7.1.3)?

New Member

Same problem Here!
Thanks.
Caio

0 Karma
Highlighted

Re: Can you help me with the following authentication error with AWS Trusted Advisor Plugin (Splunk Enterprise 7.1.3)?

New Member

Same issue...

0 Karma
Highlighted

Re: Can you help me with the following authentication error with AWS Trusted Advisor Plugin (Splunk Enterprise 7.1.3)?

Same issue here, error message below:

UnboundLocalError: local variable 'access_key_id' referenced before assignment

Any updates around this? I attempted to make the variables global but this made the inputs web page break.

Highlighted

Re: Can you help me with the following authentication error with AWS Trusted Advisor Plugin (Splunk Enterprise 7.1.3)?

Contributor

Hi,
I've just uploaded a new version of the app (1.0.3) which should be available shortly.
Please do get in touch directly if there are any issues that I can help with, contact details are on the App page on Splunkbase!
Cheers

0 Karma
Highlighted

Re: Can you help me with the following authentication error with AWS Trusted Advisor Plugin (Splunk Enterprise 7.1.3)?

Contributor

This application has now been updated to resolve this issue.

0 Karma