Splunk AWS inspector errors

[arlombar]

I am getting the below error in the splunk_ta_aws_inspector.log:

level=ERROR pid=1042 tid=MainThread logger=splunk_ta_aws.modinputs.inspector pos=util.py:call:163 | | message="Failed to execute function=run, error=Traceback (most recent call last):
File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/splunktalib/common/util.py", line 160, in call
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/inspector/init.py", line 53, in run
do_run()
File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/inspector/init.py", line 30, in _do_run
aiconf.AWSInspectorConf, "aws_inspector", logger)
File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/common/ta_aws_common.py", line 136, in get_configs
tasks = conf.get_tasks()
File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/inspector/aws_inspector_conf.py", line 60, in get_tasks
_cleanup_checkpoints(tasks, config)
File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/inspector/aws_inspector_conf.py", line 119, in _cleanup_checkpoints
internals = store.get_state("internals")
File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/splunktalib/state_store.py", line 155, in get_state
state = json.load(jsonfile)
File "/opt/splunk/lib/python2.7/json/init.py", line 291, in load
**kw)
File "/opt/splunk/lib/python2.7/json/init_.py", line 339, in loads
return _default_decoder.decode(s)
File "/opt/splunk/lib/python2.7/json/decoder.py", line 364, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/opt/splunk/lib/python2.7/json/decoder.py", line 382, in raw_decode
raise ValueError("No JSON object could be decoded")
ValueError: No JSON object could be decoded

I have this exact same app/setup in two lower environments which working just fine and im getting data. Today when I logged in I noticed we are not longer receiving AWS logs in my production environment and this is the only error I can find. Again, I have not changed any configurations from the Splunk side and this was working the night prior. Any idea what would be causing the object error?

[FraserC1]

I'm going to answer this for anyone in the future that has this issue, below is the recommendation from Splunk support on how to fix this issue.

I first disabled the aws_inspector input then made the changes and re-enabled it.

This sorted my issue and I was able to get inspector data in to Splunk.

The recommendation is to backup and delete the file labeled internals inside the checkpoint directory at:

/$SPLUNK_HOME/var/lib/splunk/modinputs/aws_inspector

The issue is a checkpoint file has been created which contains nothing which is trying to be read.

Restart splunkd after performing this task.

---