Splunk AWS APP Billing Not working

[tpanicker]

Not working. Getting error message
Error in 'lookup' command: The lookup table 'subaccount.csv' does not exist.

[tahersb]

Why cant an IAM account with full permissions fetch that file from the S3 bucket? Its an API call afterall right?

[nkhetia]

yes, mostly you should be able to do it provided - IAM user is created under master account and specify IAM user's credentials in corpkey.

[nkhetia]

Hi,

corpkey is credentials for master aws account to fetch billing csv file from S3 bucket. if it is not provided, app won't be able to fetch billing csv file.

Thanks
Nilesh

[tahersb]

Hi ,
Is there a way to make this work without configuring the corpkey?
I have configured a subaccount under the [Keys] section.

This is what my aws.conf in SPLUNK_HOME/etc/apps/SplunkAppforAWS/local looks like:

# all this three stanzas are required, in order to run AWS App.

[keys]

# At least one entry required for this stanza

# Format : 
# <accountno> = <company/group name without space> <aws-access-key> <aws-secret-key> <monthly spend limit for this account>

#1122334455 = mycomapny-name AAAAAAAAAAAAAAAAAAAA +++++BBBBBBBBBBBBBBBBBB/BBBB   10000
12_digit_Account_Number = my_company_name my_aws_access_key my_secret_key 10000

[regions]

# At least one entry required for this stanza

rgn1 = eu-west-1
rgn2 = sa-east-1
rgn3 = us-east-1
rgn4 = ap-northeast-1
rgn5 = us-west-2
rgn6 = us-west-1
rgn7 = ap-southeast-1
rgn8 = ap-southeast-2

[misc]

# Format :

# corpkey = <company name/corp account name without space> <aws-access-key> <aws-secret-key>
#corpkey = mycompany AAAAAAAAAA  BBBBBBBBBBBBBBBBBBBB

# acno is corp account number for AWS
acno = 12_digit_Account_Number
# s3bucket is bucket name where AWS bill csv files will be dropped
s3bucket = my_s3_bucket


index=aws-data
sourcetype=aws-data
source=aws-instances (for instances data)
source=aws-bill (for billing data)

With the above configuration, the "Instance Usage - by Account" dashboard is working but the "Billing - by Account" dashboard panels report: "No results found"

Please assist.

[nkhetia · Accepted solution]

Hi Tito,

subaccount.csv will get generated once u specify all your aws accounts including master account under [keys] stanza and master account under [misc] stanza. This way master account will have to be in both [keys] as well as in [misc] stanza

After setting this up, restart splunk and u will see subaccount.csv populated.

thanks
Nilesh