All Apps and Add-ons

CloudWatch api "stalling"

pwmcity
Path Finder

After installing the aws TA, i was able to collect some cloudwatch data, but all I get now is this:

/var/log/splunk/aws_cloudwatch.log

    ...
   2015-05-22 16:27:15,112 INFO pid=4461 tid=QueryWorkerThread-2 file=aws_cloudwatch.py:_main_work_loop:582 | Queried 631 metrics with 631 failures totaling 0 statistics in 13.279s before stalling.
    2015-05-22 16:27:15,122 INFO pid=4461 tid=QueryWorkerThread-1 file=aws_cloudwatch.py:_main_work_loop:582 | Queried 638 metrics with 638 failures totaling 0 statistics in 13.282s before stalling.
    2015-05-22 16:27:15,137 INFO pid=4461 tid=QueryWorkerThread-4 file=aws_cloudwatch.py:_main_work_loop:582 | Queried 538 metrics with 538 failures totaling 0 statistics in 13.307s before stalling.
    2015-05-22 16:27:15,139 INFO pid=4461 tid=QueryWorkerThread-3 file=aws_cloudwatch.py:_main_work_loop:582 | Queried 601 metrics with 601 failures totaling 0 statistics in 13.304s before stalling.

Ideas?

0 Karma
1 Solution

klowknowz
Engager

Its actually a bad error description. If you put it in debug you will see:

'No Query Result, put back to wait queue'

That is what it triggered the failure. This is not a failure just that data was not returned for the period stated. Should be more like a warning or "No Data found".

View solution in original post

klowknowz
Engager

Its actually a bad error description. If you put it in debug you will see:

'No Query Result, put back to wait queue'

That is what it triggered the failure. This is not a failure just that data was not returned for the period stated. Should be more like a warning or "No Data found".

jcoates_splunk
Splunk Employee
Splunk Employee

well, the data is failing to be a recognizable CloudWatch message stating there is a metric to download...

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

hi, could you open a support ticket please?

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...