Getting Data In

Has anyone encountered "Enabling dead letter queue is required for the SQS queue in this input" when creating an input for ELB Access Logs?

rroman23
Engager

When trying to create an input for ELB Access Logs --> SQS Based S3, I'm receiving a warning, "Enabling dead letter queue is required for the SQS queue in this input." We ran through the steps to create the dead letter queue and continue to see the same message. Has anyone encountered this?

dpolochefm
Explorer

There are two types of deadletter queues, if your queue does not end in .fifo in the name, you may need to add it as follows: "Crete New Input" --> "Custom Data Type" --> "SQS". As opposed to "SQS Based S3".

alt text

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...