We are using Splunk App + Add-on for AWS, latest versions: 4.1.0 and 3.0.0.
We are behind a proxy, which we have correctly configured in the Add-on Proxy settings and etc/splunk-launch.conf.
For any Input we try to add from the App, we keep getting errors similar to these:
Unexpected error occurs. In handler 'splunk_app_aws_aws_metrics': Unable to xml-parse the following data: reply: 'HTTP/1.1 200 Connection established\r\n' send: u'GET https://monitoring.ap-northeast-1.amazonaws.com/?Action=ListMetrics&. See splunkd.log for full data. Unexpected error occurs. In handler 'splunk_app_aws_aws_sqs': Unable to xml-parse the following data: reply: 'HTTP/1.1 200 Connection established\r\n' send: u'GET https://ap-northeast-1.queue.amazonaws.com/?Action=ListQueues&Versio. See splunkd.log for full data.
The splunkd.log has the full XML response, which looks good to me (it has all the data).
ERROR AdminManagerExternal - Received malformed XML from external handler:\nreply: 'HTTP/1.1 200 Connection established\r\n'\nsend: u'GET https://monitoring.ap-northeast-1.amazonaws.com/?Action=ListMetrics&Version=2010-08-01 HTTP/1.1\r\nAccept-Encoding: identity\r\nHost: monitoring.ap-northeast-1.amazonaws.com\r\nUser-Agent: Boto/2.38.0 Python/2.7.9 Linux/3.10.0-327.el7.x86_64\r\nContent-Length: [...]
So it looks to me like Splunk is not able to parse the responses, although they look valid to me.
Some inputs are already working correctly (Description, Billing, Cloudtrail). We just cannot get past adding those inputs that require to communicate to the AWS API at configuration time.
Is anyone using a proxy and successfully configured all the AWS services?
Proxy is supported in AWS App 4.1 and Add-on 3.0. Which proxy do you use? Could you post the proxy name and version? Did you get failure in all inputs, or some of the inputs?
well, I run into the similar problem when trying to setup splunk app for AWS (4.1.1). I'm not using proxy of any kind, and also some inputs are already working correctly (like in-Use Reserved EC2 Instances count in Usage). We just cannot get pass setup CloudWatch. No matter what AWS account I select, no matter what regions I select, the "loading services... Please wait" ways take forever and then fail. Did I missed anything?
If thare are lots of instances or metrics in your env, the query will timed out eventually. Still you can go ahead to use AddOn's configuration UI to do configuration. We will fix this problem in next release.