Splunk Dev

Getting error when trying to send cloud watch alerts using lambda function in AWS.

nagarajsf
Explorer

Hi,

I'm trying send cloud watch alerts to Splunk using lambda and I created lambda function using blueprint "splunk-cloudwatch-logs-processor" in AWS but function throwing me an error:

 

 

START RequestId: 61c99093-e39e-4e86-90b3-1b97415aaa2c Version: $LATEST
2020-07-23T23:29:33.236Z	61c99093-e39e-4e86-90b3-1b97415aaa2c	INFO	Received event: {
  "key1": "value1",
  "key2": "value2",
  "key3": "value3"
}
2020-07-23T23:29:33.236Z	61c99093-e39e-4e86-90b3-1b97415aaa2c	ERROR	Invoke Error 	{"errorType":"TypeError","errorMessage":"Cannot read property 'data' of undefined","stack":["TypeError: Cannot read property 'data' of undefined","    at Runtime.exports.handler (/var/task/index.js:31:47)","    at Runtime.handleOnce (/var/runtime/Runtime.js:66:25)"]}
END RequestId: 61c99093-e39e-4e86-90b3-1b97415aaa2c
REPORT RequestId: 61c99093-e39e-4e86-90b3-1b97415aaa2c	Duration: 4.30 ms	Billed Duration: 100 ms	Memory Size: 512 MB	Max Memory Used: 66 MB	

 

 

Any suggestions?

Thanks.

0 Karma

jschroederevers
Explorer

We had the same problem when trying to set this up for the first time. We discovered that the lambda function is expecting the json from CloudWatch and not the default test event. The CloudWatch json has a data field that the function decodes from base64. Replacing the test event with the json below should work.

{
  "awslogs": {
    "data": "QVdTIGxvZyBjb250ZW50"
  }
}

 

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...