All Apps and Add-ons

Splunk AWS APP Billing Not working

tpanicker
Explorer

Not working. Getting error message
Error in 'lookup' command: The lookup table 'subaccount.csv' does not exist.

Tags (3)
1 Solution

nkhetia
Path Finder

Hi Tito,

subaccount.csv will get generated once u specify all your aws accounts including master account under [keys] stanza and master account under [misc] stanza. This way master account will have to be in both [keys] as well as in [misc] stanza

After setting this up, restart splunk and u will see subaccount.csv populated.

thanks
Nilesh

View solution in original post

0 Karma

tahersb
New Member

Why cant an IAM account with full permissions fetch that file from the S3 bucket? Its an API call afterall right?

0 Karma

nkhetia
Path Finder

yes, mostly you should be able to do it provided - IAM user is created under master account and specify IAM user's credentials in corpkey.

0 Karma

nkhetia
Path Finder

Hi,

corpkey is credentials for master aws account to fetch billing csv file from S3 bucket. if it is not provided, app won't be able to fetch billing csv file.

Thanks
Nilesh

0 Karma

tahersb
New Member

Hi ,
Is there a way to make this work without configuring the corpkey?
I have configured a subaccount under the [Keys] section.

This is what my aws.conf in SPLUNK_HOME/etc/apps/SplunkAppforAWS/local looks like:

# all this three stanzas are required, in order to run AWS App.

[keys]

# At least one entry required for this stanza

# Format : 
# <accountno> = <company/group name without space> <aws-access-key> <aws-secret-key> <monthly spend limit for this account>

#1122334455 = mycomapny-name AAAAAAAAAAAAAAAAAAAA +++++BBBBBBBBBBBBBBBBBB/BBBB   10000
12_digit_Account_Number = my_company_name my_aws_access_key my_secret_key 10000

[regions]

# At least one entry required for this stanza

rgn1 = eu-west-1
rgn2 = sa-east-1
rgn3 = us-east-1
rgn4 = ap-northeast-1
rgn5 = us-west-2
rgn6 = us-west-1
rgn7 = ap-southeast-1
rgn8 = ap-southeast-2

[misc]

# Format :

# corpkey = <company name/corp account name without space> <aws-access-key> <aws-secret-key>
#corpkey = mycompany AAAAAAAAAA  BBBBBBBBBBBBBBBBBBBB

# acno is corp account number for AWS
acno = 12_digit_Account_Number
# s3bucket is bucket name where AWS bill csv files will be dropped
s3bucket = my_s3_bucket


index=aws-data
sourcetype=aws-data
source=aws-instances (for instances data)
source=aws-bill (for billing data)

With the above configuration, the "Instance Usage - by Account" dashboard is working but the "Billing - by Account" dashboard panels report: "No results found"

Please assist.

0 Karma

nkhetia
Path Finder

Hi Tito,

subaccount.csv will get generated once u specify all your aws accounts including master account under [keys] stanza and master account under [misc] stanza. This way master account will have to be in both [keys] as well as in [misc] stanza

After setting this up, restart splunk and u will see subaccount.csv populated.

thanks
Nilesh

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...