Splunk Enterprise

Unable to parse message

taka
Engager

I used Splunk Add on for AWS to send log files stored in S3 to SQS using S3 event notifications, and configured Splunk to read the log files from SQS.

127f8442-ec25-4753-a79b-1f3d2ae825ea.png

 

However, I got an error saying that the S3 test message that is always sent first by S3 event notifications could not be parsed.

スクリーンショット 2024-04-12 9.58.09.png

 

Splunk on EC2 is given KMS decryption privileges as shown below.

 

            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
				"sqs:*",
                "s3:*",
                "kms:Decrypt"
            ],
            "Resource": [
				"arn:aws:sqs:ap-northeast-1:*************:poc-splunk-vpcflowlog*",
                "arn:aws:s3:::poc-splunk-vpcflowlog",
                "arn:aws:s3:::poc-splunk-vpcflowlog/*"

 

 

What could be the cause?

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...