All Apps and Add-ons

Cloudtrail aws-cloudtrail.py error

atanasoffa
Explorer

Hello:

I am trying to ingest Cloudtrail data into Splunk App for AWS. When i look at the internal logs for this script, I get the following errors regarding the run() method in the script:

ERROR ExecProcessor - message from "python /apps/splunk/etc/apps/SplunkAppforAWS/bin/aws-cloudtrail.py" KeyError: 'Message'
ERROR ExecProcessor - message from "python /apps/splunk/etc/apps/SplunkAppforAWS/bin/aws-cloudtrail.py" message = json.loads(envelope["Message"])
ERROR ExecProcessor - message from "python /apps/splunk/etc/apps/SplunkAppforAWS/bin/aws-cloudtrail.py" File "/apps/splunk/etc/apps/SplunkAppforAWS/bin/aws-cloudtrail.py", line 205, in run

Has anyone remediated this already?

Thanks in advance.

0 Karma
1 Solution

grinabms
Explorer

BTW, I checked my old splunkd.log files, and that's exactly the error message I was getting. The fix in the other thread solved my problem.

-Pete

View solution in original post

0 Karma

grinabms
Explorer

BTW, I checked my old splunkd.log files, and that's exactly the error message I was getting. The fix in the other thread solved my problem.

-Pete

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...