All Apps and Add-ons

[Bug Report - Reported To Devs] If You Are Having Some Issues With Missing Entities in SAI, This May Help


Hi Folks; So Hopefully I have the blessing of the folks from the slack channel that I have been working with but I wanted to make sure to share this out with folks who may be having the same issue. Basically I was having problems with a bunch of my entities, especially AWS EC2 instances. After digging through the code, I found an issue with a few of the searches where we were missing wrapped quotes in some of the key value pairs. This was causing a few issues with some tag values that had spaces in them.

To Use


With the one included in the attached zip file.

I've already opened a case with Support and spoken to the folks on Slack, and i believe they are working on the fix but I wanted to make sure that anyone else who is experiencing this issue has a gap fill until a new release 🙂 update

For those interested in where the changes were:

under 'get_all_dims_from_dims_name'

       for d in dims_name:
            if d not in id_dims_name:
                values_part += 'values("%s") as "%s" ' % (d, d)
        spl = '| mcatalog %s WHERE metric_name=%s AND (`sai_metrics_indexes`) BY %s' % (
            values_part, predicate, id_predicate)

and 'get_dimension_names_by_id_dims'

        for iden in iden_fields:
            fields_part += 'values("%s") ' % iden
        fields_list = ', '.join(iden_fields)
        spl = '| mcatalog %s, values("_dims") as "dims" WHERE metric_name=%s AND (`sai_metrics_indexes`) BY %s \
            | table dims' % (fields_part, predicate, fields_list)

Splunk Employee
Splunk Employee

The internal bug reference is SII-3114. The fix should be part of a futur version.

0 Karma


That's great! If you need someone to do some testing, feel free to reach out!

0 Karma

Splunk Employee
Splunk Employee

Just a very belated update: This was fixed as part of version 1.2.2. Thanks for the reporting and debugging!

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...