All Apps and Add-ons

Splunk Add-on for Amazon Web Services: Why am I unable to connect and pull metrics from Cloudwatch?

bhbritton
New Member

Having issues pulling back metrics from Cloudwatch. There are a number of running instances with metrics I should be able to retrieve. I have also been able to retrieve this from other monitoring applications.

Here is what I am getting in the log.

2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:890 | STARTED: 
2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:prune:159 | Checkpointer pruned 0 of 0 items leaving 0 items.
2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:__init__:65 | Checkpointer recovered from C:\Program Files\Splunk\var\lib\splunk\modinputs\aws_cloudwatch
2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:get_access_key_pwd_real:773 | get account name: Traverse
2015-12-04 15:50:22,391 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:_expand_stanza_metrics:839 | Getting account ID from user arn splitted by ":".
2015-12-04 15:50:25,451 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:931 | input_name: [aws_cloudwatch://Cloudwatch_Local] metric_count: 0
2015-12-04 15:50:25,451 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:937 | total_metric_count: 0
2015-12-04 15:50:25,451 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:__init__:72 | Checkpointer initialized from wait queue
2015-12-04 15:50:25,457 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:save:140 | Checkpointer saved 0 items in 0.006000 seconds to: C:\Program Files\Splunk\var\lib\splunk\modinputs\aws_cloudwatch\checkpointer.json
2015-12-04 15:50:25,460 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:985 | query work queued = 0, deferred = 0 , scan_time = 0.000s
2015-12-04 15:51:01,480 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:985 | query work queued = 0, deferred = 0 , scan_time = 0.000s

Here is my input configuration:

[aws_cloudwatch://Cloudwatch_Local]
aws_account = Traverse
aws_region = ap-southeast-2
metric_dimensions = {"InstanceID" : "i-*"}
metric_names = ["CPUUtilization"]
metric_namespace = AWS/EC2
period = 60
polling_interval = 60
sourcetype = aws:cloudwatch
statistics = ["Average"]
index = aws_cloud
0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

pruned 0, queued 0, deferred 0, scan time 0... it's not seeing anything to do in that queue. Maybe wrong queue? Maybe blacklisting or filtering in some way? Maybe permissions?

View solution in original post

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

pruned 0, queued 0, deferred 0, scan time 0... it's not seeing anything to do in that queue. Maybe wrong queue? Maybe blacklisting or filtering in some way? Maybe permissions?

View solution in original post

0 Karma

bhbritton
New Member

Was an issue with formatting...

metric_dimensions = [{"InstanceId":["i-.*"]}]
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.