All Apps and Add-ons

Push Cloudwatch metrics source type

AnanthaS
Path Finder

I am able to push cloudwatch metrics by selecting streaming and selecting json as datatype of output. Additionally I used inbuilt lambda transformation for cloudwatch metrics. I selected source type aws:firehose:json. The data is seen in Splunk as json data which is not searchable. How to get the data in searchable format?

Labels (2)
0 Karma

marnall
Motivator

When you say "seen in Splunk as json data which is not searchable", do you mean the data is not at all appearing in Splunk, or it is possible to use search to retrieve the logs but they do not extract fields?

Splunk handles JSON logs straightforwardly so if the logs do reach splunk in proper JSON format then it should have no problem indexing the logs and even automatically extracting fields.

0 Karma

AnanthaS
Path Finder

Right, it doesn't extract the fields but the data is available. Using JSON functions possibly the data can be queries but that is cumbersome.

0 Karma

AnanthaS
Path Finder

Thanks for your reply on this. We were seeing JSON array, which Splunk failed to recognize and make it searchable.

We were using Lambda for transformation and one change to Firehose configuration from "Raw" to "Event" for the field "Splunk End Point" helped resolve the issue. 

Also, I change the source type "aws:cloudwatch" to based on the tests written for lambda.

https://github.com/splunk/splunk-aws-cloudwatch-streaming-metrics-processor/blob/main/SplunkAWSCloud... 

It will be good if the documentation - Source types for the Splunk Add-on for AWS - Splunk Documentation

also can be updated to say the source type "aws:cloudwatch" to be used if Lambda function - splunk-aws-cloudwatch-streaming-metrics-processor is used for streaming.

This request can be closed with above comments. 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...