All Apps and Add-ons

Splunk Add-on for Amazon Web Services: Alert isn't published to SNS due to empty message content

splunk82
New Member

Hi,

I am using the Splunk Add-on and App for Amazon Web Services (AWS). I enabled one of the default alerts and added a AWS Simple Notification Service (SNS) alert for trigger actions. But i am not receiving SNS alerts.

When i check the logs, I see "SNSPublisherError: Alert isn't published to SNS due to empty message content"

Mandatory fields for SNS alerts are Account, Region, Topic Name, Message ($result.message$) and all of them are correct. Can someone point me in the right direction as to what i might be missing?

0 Karma

lim2
Communicator

your SPL output|eval message= host." ".sourcetype ." ". _raw|awssnsalert account="Account_to_connect_AWS" region="us-east-1" topic_name="topic_name" publish_all=1

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...