https://community.splunk.com/t5/All-Apps-and-Add-ons/Resource-Activity-Dashboard-is-not-working-in-Splunk-AWS-App/m-p/486311#M59804 <P>Hi Team,<BR /> We could see Configuration changes Trellis populating data on Overview dashboards in Splunk App for Aws. But once we tried drilling it down to Resource Activity monitor, then there is no single panel which is populating data for the same.<BR /> We tried investigating search query for changes over time <BR /> <CODE>aws-config-notification( (aws_account_id="*") , (region="*") )</CODE> configurationItem.resourceType=TERM(*) configurationItemDiff.changeType=DELETE | timechart count by configurationItemDiff.changeType</P> <P>In this query all macros are working but query is failing at configurationItem.resourceType=TERM(*) configurationItemDiff.changeType=DELETE | timechart count by configurationItemDiff.changeType</P> <P>Could you please help me to understand what actions do i need to take? <BR /> Also we did some trial and error basis troubleshooting like working with Field Aliases but it fails.<BR /> So we tried creating fields aliases for testing purpose which works with Search app but it is not working for aws app (we have rectified permission issue but dont think anything is wrong with it)</P> Mon, 18 Nov 2019 11:30:15 GMT Ajinkya1992 2019-11-18T11:30:15Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Resource-Activity-Dashboard-is-not-working-in-Splunk-AWS-App/m-p/486311#M59804 <P>Hi Team,<BR /> We could see Configuration changes Trellis populating data on Overview dashboards in Splunk App for Aws. But once we tried drilling it down to Resource Activity monitor, then there is no single panel which is populating data for the same.<BR /> We tried investigating search query for changes over time <BR /> <CODE>aws-config-notification( (aws_account_id="*") , (region="*") )</CODE> configurationItem.resourceType=TERM(*) configurationItemDiff.changeType=DELETE | timechart count by configurationItemDiff.changeType</P> <P>In this query all macros are working but query is failing at configurationItem.resourceType=TERM(*) configurationItemDiff.changeType=DELETE | timechart count by configurationItemDiff.changeType</P> <P>Could you please help me to understand what actions do i need to take? <BR /> Also we did some trial and error basis troubleshooting like working with Field Aliases but it fails.<BR /> So we tried creating fields aliases for testing purpose which works with Search app but it is not working for aws app (we have rectified permission issue but dont think anything is wrong with it)</P> Mon, 18 Nov 2019 11:30:15 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Resource-Activity-Dashboard-is-not-working-in-Splunk-AWS-App/m-p/486311#M59804 Ajinkya1992 2019-11-18T11:30:15Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Resource-Activity-Dashboard-is-not-working-in-Splunk-AWS-App/m-p/518820#M63379 <P>Hi,</P><P>Did you end up resolving this issue? I also have the same problem.</P> Thu, 10 Sep 2020 06:45:41 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Resource-Activity-Dashboard-is-not-working-in-Splunk-AWS-App/m-p/518820#M63379 lznger88_2 2020-09-10T06:45:41Z