Been trying to get the AWS app working and the ec2 dashboards are not working... I have traced it down to it looking like every search is just plain wrong... as an example:
`aws-description-sourcetype` $accountId$ $region$ source="*:$resource$" | eventstats latest(_time) as latest_time | eval latest_time=relative_time(latest_time,"-55m") | where _time > latest_time | dedup id sortby -start_time
The problem is at `dedup id sortby -start_time`. There is no "id" field on the data... there is however "InstanceId". It is a similar situation for every dashboard that is not populating which leads me to believe there is a job somewhere that is not running or I am missing some very fundamental thing. Any help would be greatly appreciated... Thanks!
