All Apps and Add-ons

Resource Activity Dashboard is not working in Splunk AWS App

Path Finder

Hi Team,
We could see Configuration changes Trellis populating data on Overview dashboards in Splunk App for Aws. But once we tried drilling it down to Resource Activity monitor, then there is no single panel which is populating data for the same.
We tried investigating search query for changes over time
aws-config-notification( (aws_account_id="*") , (region="*") ) configurationItem.resourceType=TERM(*) configurationItemDiff.changeType=DELETE | timechart count by configurationItemDiff.changeType

In this query all macros are working but query is failing at configurationItem.resourceType=TERM(*) configurationItemDiff.changeType=DELETE | timechart count by configurationItemDiff.changeType

Could you please help me to understand what actions do i need to take?
Also we did some trial and error basis troubleshooting like working with Field Aliases but it fails.
So we tried creating fields aliases for testing purpose which works with Search app but it is not working for aws app (we have rectified permission issue but dont think anything is wrong with it)

0 Karma

Explorer

Hi,

Did you end up resolving this issue? I also have the same problem.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!