All Apps and Add-ons

How can I generate all_account_ids.csv with the Splunk Add-on for Amazon Web Services on a separate host?

drutstein
Explorer

We have the Splunk Add-on for Amazon Web Services running on a cluster of heavy forwarders pulling most data in from S3 inputs. The only exception is the description/metadata input which is configured through the bin/tools/configure/aws_config_cli.py command. Due to this separation it looks like the all_account_ids.csv lookup doesn't get generated to be used in the AWS App. How can I generate this separately?

abhijeetsapre
New Member

Use following in search for Splunk App for AWS

index=your_aws_index sourcetype="aws:addon:account" | dedup host, account_id, name | fields - _time |dedup account_id| table name, account_id | outputlookup all_account_ids

This should help.

0 Karma
Get Updates on the Splunk Community!

Alpha Launch: AI-Assisted Auto-Schematization for CIM

Streamlining Data Onboarding: Announcing the Alpha Release of AI-Assisted Auto-Schematization For many Splunk ...

Enterprise Security(ES) Essentials or Premier? Let's discuss Splunk ES Editions on ...

  Hi everyone, Last year at .conf25, we shared something exciting: Splunk Enterprise Security is evolving ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 5

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...