All Apps and Add-ons

[Bug Report - Reported To Devs] If You Are Having Some Issues With Missing Entities in SAI, This May Help

paimonsoror
Builder

Hi Folks; So Hopefully I have the blessing of the folks from the slack channel that I have been working with but I wanted to make sure to share this out with folks who may be having the same issue. Basically I was having problems with a bunch of my entities, especially AWS EC2 instances. After digging through the code, I found an issue with a few of the searches where we were missing wrapped quotes in some of the key value pairs. This was causing a few issues with some tag values that had spaces in them.

To Use
Replace:

{SPLUNK_HOME}/etc/apps/splunk_app_infrastructure/bin/em_search_manager.py

With the one included in the attached zip file.

I've already opened a case with Support and spoken to the folks on Slack, and i believe they are working on the fix but I wanted to make sure that anyone else who is experiencing this issue has a gap fill until a new release 🙂

em_search_manager.py update

For those interested in where the changes were:

under 'get_all_dims_from_dims_name'

       for d in dims_name:
            if d not in id_dims_name:
                values_part += 'values("%s") as "%s" ' % (d, d)
        spl = '| mcatalog %s WHERE metric_name=%s AND (`sai_metrics_indexes`) BY %s' % (
            values_part, predicate, id_predicate)

and 'get_dimension_names_by_id_dims'

        for iden in iden_fields:
            fields_part += 'values("%s") ' % iden
        fields_list = ', '.join(iden_fields)
        spl = '| mcatalog %s, values("_dims") as "dims" WHERE metric_name=%s AND (`sai_metrics_indexes`) BY %s \
            | table dims' % (fields_part, predicate, fields_list)

yannK
Splunk Employee
Splunk Employee

The internal bug reference is SII-3114. The fix should be part of a futur version.

0 Karma

paimonsoror
Builder

That's great! If you need someone to do some testing, feel free to reach out!

0 Karma

pwu_splunk
Splunk Employee
Splunk Employee

Just a very belated update: This was fixed as part of version 1.2.2. Thanks for the reporting and debugging!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...