All Apps and Add-ons

AWS GuardDuty - SQS Input - Dashboards not Populating Finding Details

hnakhla
New Member

Hello,

I'm using AWS GuardDuty Add-on with an SQS input as appose to the Lambda HEC method. The findings are indexed correctly in Search. However, the add-on dashboards are not mapping/pulling Finding data correctly.

  1. Is there a known issue with using generic SQS input(pull method) as appose to the Lambda HEC (push method)?

  2. If the above is true, is there a published troubleshooting guide to help users modify dashboard/drilldown XML to fix the dashboard mapping/search issues?

  3. The add-on is currently -not supported- does that mean Splunk Support will no longer be able to help update the add-on or debug issues moving forward?

Thanks!

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...