All Apps and Add-ons

How can I generate all_account_ids.csv with the Splunk Add-on for Amazon Web Services on a separate host?

Explorer

We have the Splunk Add-on for Amazon Web Services running on a cluster of heavy forwarders pulling most data in from S3 inputs. The only exception is the description/metadata input which is configured through the bin/tools/configure/aws_config_cli.py command. Due to this separation it looks like the all_account_ids.csv lookup doesn't get generated to be used in the AWS App. How can I generate this separately?

New Member

Use following in search for Splunk App for AWS

index=your_aws_index sourcetype="aws:addon:account" | dedup host, account_id, name | fields - _time |dedup account_id| table name, account_id | outputlookup all_account_ids

This should help.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!