About grinabms

grinabms · ‎10-08-2015

Yes, it is running on http, and definitely not https. -Pete

grinabms · ‎10-06-2015

I tried removing the two apps (Splunk for AWS, and the AWS add-on) by removing all files in /opt/splunk/etc/apps/* and /opt/splunk/etc/user/* that was related to those two apps. Current app and previous app related stuff was deleted. Next, I re-downloaded and re-installed the latest Splunk for AWS, and the add-on. Unfortunately, the SSL error appeared again when I clicked the Configure tab. I decided to spin up a fresh new EC2 instance, install Splunk v6.3, and the apps. Everything went well, and now I'm able to configure my AWS accounts without a problem. Regards, Pete

grinabms · ‎09-28-2015

The same error happens when I click CONFIGURE on a different browser (Firefox instead of Chrome), so it's not a matter of bad data stuck in cache. This is a single instance Splunk environment. I couldn't find any evidence of explicit SSL in my old configs... where would that be located? Regarding version numbers, the "Add-on for AWS" went from 1.1.1 to 2.0.0, and the "App for AWS" went from 3,0 to 4.0.0. I don't remember whether overwrite was checked, but I followed the upgrade instructions carefully. I made a custom modification in "App for AWS" before version 3.0, but I don't believe it was active in 3.0. -Pete Thanks, Pete

grinabms · ‎09-24-2015

I am running Splunk Enterprise v6.3 on a Linux instance in AWS. The Splunk and Splunk-App-for-AWS have been upgraded from older versions. I had 5 AWS accounts configured in the older app. Yesterday, I upgraded to Splunk App for AWS v4.0, and the Splunk Add-on for AWS v2.0. I disabled the older versions through the Splunk UI. Thanks, Pete (grinabms)

grinabms · ‎09-23-2015

After installing v4.0, I am trying to follow the instructions to import my AWS account info into the new app. Unfortunately, when I click on CONFIGURE, I get an error stating: In handler 'targets': Unexpected error "" from python handler: "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:595)". See splunkd.log for more details. The splunkd.log file shows this stack trace. Sorry about the word-wrap in my cut and paste attempt. 09-23-2015 17:16:11.995 +0000 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 70, in init\n hand.execute(info)\n File "/opt/splunk/lib/python2.7/s ite-packages/splunk/admin.py", line 529, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/opt/splunk/etc/apps/splunk_app_aws/bin/target_handler.py", line 57, in handleList\n targets = self.get_target_manager().list_target s()\n File "/opt/splunk/etc/apps/splunk_app_aws/bin/target_handler.py", line 89, in _get_target_manager\n return tm.TargetManager(app=self.appName, owner=self.userName, session_key=self.getSessionKey())\n File "/opt/splunk/etc/apps/splunk_app_aws/bin/aws/target_manag er.py", line 25, in __init\n if CONF_TARGET not in self._service.confs:\n File "/opt/splunk/etc/apps/splunk_app_aws/bin/splunklib/client.py", line 1661, in __contains\n response = self.get(key)\n File "/opt/splunk/etc/apps/splunk_app_aws/bin/splunklib/client.p y", line 1611, in get\n return super(Collection, self).get(name, owner, app, sharing, **query)\n File "/opt/splunk/etc/apps/splunk_app_aws/bin/splunklib/client.py", line 709, in get\n **query)\n File "/opt/splunk/etc/apps/splunk_app_aws/bin/splunklib/binding.py", line 241, in wrapper\n return request_fun(self, *args, **kwargs)\n File "/opt/splunk/etc/apps/splunk_app_aws/bin/splunklib/binding.py", line 63, in new_f\n val = f(*args, **kwargs)\n File "/opt/splunk/etc/apps/splunk_app_aws/bin/splunklib/binding.py", line 586, in get\n response = self.http.get(path, self._auth_headers, **query)\n File "/opt/splunk/etc/apps/splunk_app_aws/bin/splunklib/binding.py", line 1056, in get\n return self.request(url, { 'method': "GET", 'headers': headers })\n File "/opt/splunk/etc/apps/splunk_app aws/bin/splunklib/binding.py", line 1108, in request\n response = self.handler(url, message, **kwargs)\n File "/opt/splunk/etc/apps/splunk_app_aws/bin/splunklib/binding.py", line 1230, in request\n connection.request(method, path, body, head)\n File "/opt/splunk/l ib/python2.7/httplib.py", line 1001, in request\n self.send_request(method, url, body, headers)\n File "/opt/splunk/lib/python2.7/httplib.py", line 1035, in _send_request\n self.endheaders(body)\n File "/opt/splunk/lib/python2.7/httplib.py", line 997, in endheade rs\n self._send_output(message_body)\n File "/opt/splunk/lib/python2.7/httplib.py", line 850, in _send_output\n self.send(msg)\n File "/opt/splunk/lib/python2.7/httplib.py", line 812, in send\n self.connect()\n File "/opt/splunk/lib/python2.7/httplib.py", line 1212, in connect\n server_hostname=server_hostname)\n File "/opt/splunk/lib/python2.7/ssl.py", line 350, in wrap_socket\n _context=self)\n File "/opt/splunk/lib/python2.7/ssl.py", line 566, in __init_\n self.do_handshake()\n File "/opt/splunk/lib/python2.7/s sl.py", line 788, in do_handshake\n self._sslobj.do_handshake()\nSSLError: [SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:595)\n

grinabms · ‎09-23-2015

The first part of the original post explains why he/she couldn't open a support case. I get the same error, namely when I click on "file a case", I get redirected to some odd error page telling me that my SSO cert failed, and I need to contact my salesforce.com administrator. Is there a workaround for that error? I am trying to open a case (unrelated to the original poster's case)

grinabms · ‎05-05-2014

For the instance, volume, and EBS usage, the app writes logs into $SPLUNK_HOME/etc/apps/SplunkAppforAWS/log. Take a look to see if you have any log data in opstmp.txt, final22.txt, ci1.txt, and ebs1.txt. These files are overwritten every time the scripts run. When the scripts are running correctly, here is a sample of the file contents: opstmp.txt: 05-05-2014 14:29:00 +0000 subaccount=pete region=us-east-1d instanceid=i-12341234 instancetype=m1.small cpuutilization=0 networkin=118 networkout=142 05-05-2014 14:28:00 +0000 subaccount=pete region=us-east-1d instanceid=i-12341234 instancetype=m1.small cpuutilization=0 networkin=42 networkout=28 ebs1.txt: 05-05-2014 14:36:24 +0000 subaccountid=123412341234 region=us-east-1 start_time=2014-01-15T13:11:29.000Z snap_id=snap-12341234 size=35 vol_snapshot_id=vol-12341234 snap_tags=[Name=hpwin-root] stype=S 05-05-2014 14:36:24 +0000 subaccountid=123412341234 region=us-east-1 start_time=2014-03-17T18:49:04.000Z snap_id=snap-12341234 size=8 vol_snapshot_id=vol-12341234 snap_tags=[None] stype=S ci1.txt: 05-05-2014 14:36:24 +0000 instancetype=m3.medium region=us-east-1b subaccount=pete instanceid=i-12341234 tags=[Name=webtest] uptimedays=60 05-05-2014 14:36:24 +0000 instancetype=m1.medium region=us-east-1b subaccount=pete instanceid=i-12341234 tags=[Name=abc abc-test=DC1] uptimedays=62 final22.txt: 05-05-2014 14:36:24 +0000 instancetype=m3.medium region=us-east-1b subaccount=pete instanceid=i-12341234 tags=[Name=testutm] uptimedays=6 spot=N running=Y reserved=N 05-05-2014 14:36:24 +0000 instancetype=m1.small region=us-east-1d subaccount=pete instanceid=i-12341234 tags=[Name=newdev-test] uptimedays=6 spot=N running=Y reserved=N Hope this helps, Pete

grinabms · ‎05-05-2014

BTW, I checked my old splunkd.log files, and that's exactly the error message I was getting. The fix in the other thread solved my problem. -Pete

grinabms · ‎05-05-2014

That's the only change that I made. Can you post your error message? One suggestion is to add a debugging line to see exactly what is in the "envelope"... here is how it should look: logging.info("envelope: %s",json.dumps(envelope)) #message = json.loads(envelope["Message"]) message = envelope When you save the edit, then your splunkd.log file should contain log entries like this: 03-25-2014 23:25:54.726 +0000 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/SplunkAppforAWS/bin/aws-cloudtrail.py" envelope: {"s3ObjectKey": ["AWSLogs/123412341234/CloudTrail/us-east-1/2014/03/24/123412341234_CloudTrail_us-east-1_20140324T1645Z_pUiRsGvGTkwgBOoL.json.gz"], "s3Bucket": "my-log-bucket"}

grinabms · ‎03-14-2014

I got my Cloudtrail logs into SplunkAppforAWS with a small change in aws-cloudtrail.py. Background: Cloudtrail data wasn't feeding into my dashboards, and I saw a steady stream of errors in $SPLUNK_HOME/var/log/splunk/splunkd.log. Same error message: 03-10-2014 04:53:56.015 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/SplunkAppforAWS/bin/aws-cloudtrail.py" KeyError: 'Message' The solution was to edit $SPLUNK_HOME/etc/apps/SplunkAppforAWS/bin/aws-cloudtrail.py. I commented out one line, and replaced it with another. Now this appears about 200 lines down in my file: #message = json.loads(envelope["Message"]) message = envelope Make this change, and in a few minutes, the errors in the splunkd.log disappear, and data begins to populate the dashboards. Hope this helps. -Pete

Posts	10
Solutions	1
Karma Given	0
Karma Received	1
Member Since	‎02-24-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

"Configure" error in version 4.0

Re: "Configure" error in version 4.0

Re: "Configure" error in version 4.0

Re: "Configure" error in version 4.0

Re: "Configure" error in version 4.0

"Configure" error in version 4.0

Re: eventtype BUG

Re: Splunk AWS App - Instance Usage Info Not Showi...

Re: Cloudtrail aws-cloudtrail.py error

Re: Splunk For AWS Problem

Re: Splunk For AWS Problem