HELP (Again)! Trying to Push Logs from AWS Kinesis to Splunk via HEC Using Lambda Function but getting no events on splunk
This is my lambda_function.py code. I am getting { "statusCode": 200, "body": "Data processed successfully"} still no logs also there is no error reported in splunkd. I am able to send events via curl & postman for the same index. Please help me out. Thanks
import json
import requests
import base64
# Splunk HEC Configuration
splunk_url = "https://127.0.0.1:8088/services/collector/event" # Replace with your Splunk HEC URL
splunk_token = "6abc8f7b-a76c-458d-9b5d-4fcbd2453933" # Replace with your Splunk HEC token
headers = {"Authorization": f"Splunk {splunk_token}"} # Add the Splunk HEC token in the Authorization header
def lambda_handler(event, context):
try:
# Extract 'Records' from the incoming event object (Kinesis event)
records = event.get("Records", [])
# Loop through each record in the Kinesis event
for record in records:
# Extract the base64-encoded data from the record
encoded_data = record["kinesis"]["data"]
# Decode the base64-encoded data and convert it to a UTF-8 string
decoded_data = base64.b64decode(encoded_data).decode('utf-8') # Decode and convert to string
# Parse the decoded data as JSON
payload = json.loads(decoded_data) # Convert the string data into a Python dictionary
# Create the event to send to Splunk (Splunk HEC expects an event in JSON format)
splunk_event = {
"event": payload, # The actual event data (decoded from Kinesis)
"sourcetype": "manual", # Define the sourcetype for the event (used for data categorization)
"index": "myindex" # Specify the index where data should be stored in Splunk (modify as needed)
}
# Send the event to Splunk HEC via HTTP POST request
response = requests.post(splunk_url, headers=headers, json=splunk_event, verify=False) # Send data to Splunk
# Check if the response status code is 200 (success) and log the result
if response.status_code != 200:
print(f"Failed to send data to Splunk: {response.text}") # If not successful, print error message
else:
print(f"Data sent to Splunk: {splunk_event}") # If successful, print the event that was sent
# Return a successful response to indicate that data was processed without errors
return {"statusCode": 200, "body": "Data processed successfully"}
except Exception as e:
# Catch any exceptions during execution and log the error message
print(f"Error: {str(e)}")
# Return a failure response with the error message
return {"statusCode": 500, "body": f"Error: {str(e)}"}