Archive
Highlighted

Error messages using Google Cloud Platform Add-on

New Member

I have configured the add-on for Google Cloud Platform and verified that pub/sub messages are being written to the pub/sub topic from GCP and that messages are successfully being pulled from the Splunk subscription. No GCP logs are appearing in Splunk. The error seems to be internal to Splunk. I have captured error messages from 2 different relevant logs below.

The following log messages are repeated in the /opt/splunk/var/log/splunk/splunktagooglepubsubutil.log

2018-01-04 18:59:53,807 ERROR pid=470 tid=Thread-2 file=eventwriter.py:writeevents:268 | Failed to post events to HECURI=https://127.0.0.1:8088/services/collector, errorcode=400, reason={"text":"Invalid data format","code":6,"invalid-event-number":0}
2018-01-04 18:59:54,591 ERROR pid=470 tid=Thread-2 file=eventwriter.py:writeevents:268 | Failed to post events to HECURI=https://127.0.0.1:8088/services/collector, errorcode=400, reason={"text":"Invalid data format","code":6,"invalid-event-number":0}

The following log messages are repeated in the /opt/splunk/var/log/splunk/splunktagooglepubsubmain.log

2018-01-04 19:59:23,387 ERROR pid=470 tid=Thread-2 file=googlepubsubdataloader.py:indexdata:70 | Failed to collect data for project=[MYPROJECT]t, subscription=[MYSUBSCRIPTION], error=Traceback (most recent call last):
File "/opt/splunk/etc/apps/SplunkTAgoogle-cloudplatform/bin/pubsubmod/googlepubsubdataloader.py", line 64, in indexdata
self.
dosafeindex()
File "/opt/splunk/etc/apps/SplunkTAgoogle-cloudplatform/bin/pubsubmod/googlepubsubdataloader.py", line 86, in dosafeindex
for msgs in sub.pull
messages():
File "/opt/splunk/etc/apps/SplunkTAgoogle-cloudplatform/bin/googlewrapper/pubsubwrapper.py", line 85, in pull_messages
for message in messages:
TypeError: 'NoneType' object is not iterable

Tags (2)
0 Karma
Highlighted

Re: Error messages using Google Cloud Platform Add-on

Engager

This sounds similar to an issue experienced when attempting to use the add-on with version 7.x of Splunk. I don't see the version of Splunk you are using listed in your question..but if you are using a version newer then 6.5 (the last supported version listed on splunk base for this particular add-on), you might try the below fix.

If googleglobalsettings.conf does not already exist in the local directory, create the file, if not, add the below stanza to it, then restart your instance. The conf file path would be:

$SPLUNKHOME/etc/apps/SplunkTAgooglecloudplatform/local/googleglobal_settings.conf

And the stanza:

[global_settings]
 use_hec = 0