Hi,
I'm running the latest Splunk App for AWS (3.0) and Splunk Add-on for Amazon Webservices (1.01).
I'm trying to set it up to ingest my AWS Config logs. There doesn't seem to be a specific "AWS Config" data input, so I'm using the CloudTrail input and choosing my AWS Config SQS Queue. I created an aws-config index and am tagging the events with aws:config.
Here's the errors I'm seeing in /opt/splunk/var/log/splunk/aws_cloudtrail.log
2015-02-11 16:48:50,566 ERROR pid=6635 tid=MainThread file=aws_cloudtrail.py:process_notifications:351 | problems unzipping from s3:config-splunk//: IOError Not a gzipped file
2015-02-11 16:48:50,566 CRITICAL pid=6635 tid=MainThread file=aws_cloudtrail.py:stream_events:286 | Outer catchall: KeyError: 's3Bucket'
I'm a bit stuck as to what the problem is. I've tried two different AWS accounts, one using the root keys. I see my Config > SNS > SQS > S3 data looking correct in AWS. I can even download some of the files from the S3 bucket onto the Splunk server and run file and/or gunzip on it, and everything checks out fine for being a valid gzip with normal json data.
Anyone have any ideas?
Forgot to mention, the ultimate error is nothing is being ingested via the app into my index/populating the dashboards/etc...
... View more