I have configured the AWS CloudTrail with SNS and SQS.
Now I try to set up Splunk with Splunk app for AWS.
However, under "setting->Data Input", I don't see CloudTrail data input page to enter the security key, secret key, SQS Queue name, and region.
I read another similar question, and someone mentioned to update DB Connect App, but it does not help.
Could someone help to solve this problem in DETAILs...
Thanks a thousand.
I am getting the same problem. I tried using a root access key just to confirm its not permissions
Failed to fetch data: In handler 'splunk_ta_aws_sqs_queue_names': Unexpected error "" from python handler: "'error' object has no attribute 'status'". See splunkd.log for more details.
Doesn't appear to be that great - from splunkd.log
04-14-2015 13:21:12.643 -0400 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 70, in init\n hand.execute(info)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 527, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws_sqs_queue_names_handler.py", line 26, in wrapper\n result = func(*args, **kwargs)\n File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws_sqs_queue_names_handler.py", line 73, in handleList\n type(e).name, e.status, e.reason, e.error_code, e.error_message))\nAttributeError: 'error' object has no attribute 'status'\n
04-14-2015 13:21:12.643 -0400 ERROR AdminManagerExternal - Unexpected error "" from python handler: "'error' object has no attribute 'status'". See splunkd.log for more details.
I suspect that you've turned on Splunk Enterprise debug or something? I was actually referring to the Add-ons' debug logging, accessed via Manage Apps -> setup. The general troubleshooting section for Add-ons goes over what to look for: http://docs.splunk.com/Documentation/AddOns/released/Overview/Troubleshootadd-ons
I did it through the Apps-->Setup - but I was still looking in the splunkd.log for the information.
I ran the query per the link you sent
index = _internal source=aws
and I see DEBUG entries - but not errors.
The instruction you provided states:
"All settings can be configured through Splunk Web or manually in inputs.conf. ".
But in the document you provided, I could not find the web page description, e.g. where, and how.
As for the manual setup, I follow the instructions, and edited the following files:
Now I DO see my AWS account in the Add New Data page. When I selected my aws account that I previously specified in the "inputs.conf", I was asked for the AWS region. I selected the correct AWS region, and now I am asked for SQS queue name. But I got the following error:
"Failed to fetch data: In handler 'splunk_ta_aws_sqs_queue_names': Unexpected error "" from python handler: "No AWS Account is configured. Setup App first.". See splunkd.log for more details."
I think this is due to that I did not specify my AWS access key and secrete key.
1. Where is the Splunk Web to enter my account, access key and secrete key?
2. How do I configure access key and secrete key manually if I have to?
Now I do see the Data Input for AWS CloudTrail, CloudWatch, AWS Billing, and S3.
However, there is no AWS accounts for me to select. There is a help text "Select an AWS account. To configure AWS accounts, go to the setup page.".
I have problem locate this "setup page".
Could someone provide step-by-step instructions to enter my AWS credential?
This shouldn't be this difficult to add my AWS credential...