Push Cloudwatch metrics source type

[AnanthaS]

I am able to push cloudwatch metrics by selecting streaming and selecting json as datatype of output. Additionally I used inbuilt lambda transformation for cloudwatch metrics. I selected source type aws:firehose:json. The data is seen in Splunk as json data which is not searchable. How to get the data in searchable format?

[marnall]

When you say "seen in Splunk as json data which is not searchable", do you mean the data is not at all appearing in Splunk, or it is possible to use search to retrieve the logs but they do not extract fields?

Splunk handles JSON logs straightforwardly so if the logs do reach splunk in proper JSON format then it should have no problem indexing the logs and even automatically extracting fields.

[AnanthaS]

Right, it doesn't extract the fields but the data is available. Using JSON functions possibly the data can be queries but that is cumbersome.

[AnanthaS]

Thanks for your reply on this. We were seeing JSON array, which Splunk failed to recognize and make it searchable.

We were using Lambda for transformation and one change to Firehose configuration from "Raw" to "Event" for the field "Splunk End Point" helped resolve the issue. 

Also, I change the source type "aws:cloudwatch" to based on the tests written for lambda.

https://github.com/splunk/splunk-aws-cloudwatch-streaming-metrics-processor/blob/main/SplunkAWSCloud... 

It will be good if the documentation - Source types for the Splunk Add-on for AWS - Splunk Documentation

also can be updated to say the source type "aws:cloudwatch" to be used if Lambda function - splunk-aws-cloudwatch-streaming-metrics-processor is used for streaming.

This request can be closed with above comments.