All Apps and Add-ons

Splunk Add-on for AWS is not loading Proxy Settings to connect to AWS SQS Queue

augrw
Engager

Hi,

I am using the Splunk Add-on for AWS app (5.01) to ingest data from SQS/S3 to Splunk 8.0.3 on-prem.

Our network gateway requirements is that the traffic is going through a proxy.

For some reason, this add-on is not able to communicate with proxy setting to establish connection to AWS SQS queue. It's keep hitting the below errors:

level=ERROR pid=14252 tid=MainThread logger=splunk_ta_aws.modinputs.sqs.aws_sqs_data_loader pos=aws_sqs_data_loader.py:log:93 | | message="Failed to get SQS queue url"

..............................

Files\\Splunk\\etc\\apps\\Splunk_TA_aws\\bin\\3rdparty\\python3\\botocore\\httpsession.py\", line 283, in send\n raise EndpointConnectionError(endpoint_url=request.url, error=e)\nbotocore.exceptions.EndpointConnectionError: Could not connect to the endpoint URL: \"https://sts.amazonaws.com/\"\n"

==========

However, I am able to get SQS queue URL when I use AWS CLI in windows power-shell and CMD respectively:

PS C:\> aws sqs get-queue-url --queue-name C*******-Sqs
{
"QueueUrl": "https://sqs.ap-southeast-2.amazonaws.com/1*************/C***********-Sqs"
}

I noticed from the Splunk Add-on for AWS web UI there are proxy settings. When set, it generates a passwords.conf file containing a hash - I am guessing that it is the Proxy URL hashed.

As we do everything via configuration management, it would be awesome to just have this in the conf file.

I did notice that in Splunk Add-on for AWS's aws_settings.conf file, there is a Proxy stanza. When I set the options in this it doesn't take effect in the Web UI.

Where can I find the proxy conf file for this addon? How can I identify whether this addon is using my proxy settings at all?

I am stuck with this issue for days, and please help!

Labels (2)
0 Karma
1 Solution

dwest_splunk
Splunk Employee
Splunk Employee

Hi
I think there was a UI bug in version 5.0.1 of the Addon, so best use the 5.0.3 version.

Or you may be able to update by upgrading httplib2 in bin/3rdparty/python/httplib2 but I think upgrade to 5.0.3 is the easier option.

View solution in original post

0 Karma

sososplunks
Loves-to-Learn

Hi @augrw . Were you ever able to solve this issue. I'm currently facing it at the moment. 

0 Karma

dwest_splunk
Splunk Employee
Splunk Employee

Hi
I think there was a UI bug in version 5.0.1 of the Addon, so best use the 5.0.3 version.

Or you may be able to update by upgrading httplib2 in bin/3rdparty/python/httplib2 but I think upgrade to 5.0.3 is the easier option.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...