All Apps and Add-ons

Possible incorrect lookup statement in Splunk App for AWS

Path Finder

I am not seeing certain dashboard panels load data in the Splunk App for AWS and I believe it is related to a bad lookup. The lookup is lookup regions.csv region OUTPUT label as region. I do not believe you can rename (AS) the output name back to the original source field name. If I do lookup regions.csv region OUTPUT label as new_region it works or lookup regions.csv region OUTPUT label | rename label AS region it works. Should this lookup work as-is or is it a bug?

0 Karma

Splunk Employee
Splunk Employee

Hi, please try the following SQL in AWS app to see if an result. It uses the regions.csv as lookup. In my Splunk 6.3, it works. If you see any error pops, please post the error message here and the version of your splunk, as well as the content in /etc/apps/splunk_app_aws/lookups/regions.csv.

`aws-config-resources(*, *, "AWS::EC2::Volume")`
| join resourceId type="outer" [search earliest=-1d `aws-description-snapshot($accountId$, $region$)`
| rename volume_id as resourceId, id as snapshotId] 
| eval snapTime=strptime(start_time, "%Y-%m-%dT%T") 
| eval diff=round((now()-snapTime)/86400,0) 
| where NOT (diff>0 AND diff<30) 
| sort -diff
| fillnull value="N/A"
| table resourceId, region, configuration.size, configuration.volumeType, configuration.state, snapshotId,start_time, diff
| lookup regions.csv region OUTPUT label as region
| rename resourceId as ID, region as Region, configuration.size as "Size (GB)", configuration.volumeType as Type, configuration.state as State, snapshotId as "Snapshot ID", start_time as "Latest Snapshot", diff as "Snapshot Age (days)"
0 Karma

Path Finder

So no error, just the same behavior where region does not get populated. I am still running Splunk 6.2.2 (build 255606).

Example where no results come back.
index=aws sourcetype="aws:config" | lookup regions.csv region OUTPUT label as region | stats count by region

Example with the expected results.
index=aws sourcetype="aws:config" | lookup regions.csv region OUTPUT label as aa_region | stats count by aa_region

ap-northeast-1,Tokyo,35.41,139.42,"Asia Pacific (Tokyo)"
ap-southeast-1,Singapore,1.37,103.8,"Asia Pacific (Singapore)"
ap-southeast-2,Sydney,-33.86,151.2,"Asia Pacific (Sydney)"
eu-central-1,Frankfurt,50.11,8.68,"EU (Frankfurt)"
eu-west-1,Ireland,53,-8,"EU (Ireland)"
sa-east-1,Sao Paulo,-23.34,-46.38,"South America (Sao Paulo)"
us-east-1,Virginia,38.13,-78.45,"US East (N. Virginia)"
us-west-1,California,41.48,-120.53,"US West (N. California)"
us-west-2,Oregon,46.15,-123.88,"US West (Oregon)"

0 Karma

Splunk Employee
Splunk Employee

Hi, thank you for the feedback! I have tested it on both 6.2.2 and 6.2.7. It works on 6.2.7, but broken on 6.2.2 😞
So I would say it is a bug on 6.2.2

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...