[Bug Report - Reported To Devs] If You Are Having Some Issues With Missing Entities in SAI, This May Help

[paimonsoror]

Hi Folks; So Hopefully I have the blessing of the folks from the slack channel that I have been working with but I wanted to make sure to share this out with folks who may be having the same issue. Basically I was having problems with a bunch of my entities, especially AWS EC2 instances. After digging through the code, I found an issue with a few of the searches where we were missing wrapped quotes in some of the key value pairs. This was causing a few issues with some tag values that had spaces in them.

To Use
Replace:

{SPLUNK_HOME}/etc/apps/splunk_app_infrastructure/bin/em_search_manager.py

With the one included in the attached zip file.

I've already opened a case with Support and spoken to the folks on Slack, and i believe they are working on the fix but I wanted to make sure that anyone else who is experiencing this issue has a gap fill until a new release 🙂

em_search_manager.py update

For those interested in where the changes were:

under 'get_all_dims_from_dims_name'

       for d in dims_name:
            if d not in id_dims_name:
                values_part += 'values("%s") as "%s" ' % (d, d)
        spl = '| mcatalog %s WHERE metric_name=%s AND (`sai_metrics_indexes`) BY %s' % (
            values_part, predicate, id_predicate)

and 'get_dimension_names_by_id_dims'

        for iden in iden_fields:
            fields_part += 'values("%s") ' % iden
        fields_list = ', '.join(iden_fields)
        spl = '| mcatalog %s, values("_dims") as "dims" WHERE metric_name=%s AND (`sai_metrics_indexes`) BY %s \
            | table dims' % (fields_part, predicate, fields_list)

[yannK]

The internal bug reference is SII-3114. The fix should be part of a futur version.

[paimonsoror]

That's great! If you need someone to do some testing, feel free to reach out!

[pwu_splunk]

Just a very belated update: This was fixed as part of version 1.2.2. Thanks for the reporting and debugging!