All Apps and Add-ons

Splunk Add-on for Amazon Web Services: Why am I unable to connect and pull metrics from Cloudwatch?

bhbritton
New Member

Having issues pulling back metrics from Cloudwatch. There are a number of running instances with metrics I should be able to retrieve. I have also been able to retrieve this from other monitoring applications.

Here is what I am getting in the log.

2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:890 | STARTED: 
2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:prune:159 | Checkpointer pruned 0 of 0 items leaving 0 items.
2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:__init__:65 | Checkpointer recovered from C:\Program Files\Splunk\var\lib\splunk\modinputs\aws_cloudwatch
2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:get_access_key_pwd_real:773 | get account name: Traverse
2015-12-04 15:50:22,391 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:_expand_stanza_metrics:839 | Getting account ID from user arn splitted by ":".
2015-12-04 15:50:25,451 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:931 | input_name: [aws_cloudwatch://Cloudwatch_Local] metric_count: 0
2015-12-04 15:50:25,451 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:937 | total_metric_count: 0
2015-12-04 15:50:25,451 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:__init__:72 | Checkpointer initialized from wait queue
2015-12-04 15:50:25,457 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:save:140 | Checkpointer saved 0 items in 0.006000 seconds to: C:\Program Files\Splunk\var\lib\splunk\modinputs\aws_cloudwatch\checkpointer.json
2015-12-04 15:50:25,460 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:985 | query work queued = 0, deferred = 0 , scan_time = 0.000s
2015-12-04 15:51:01,480 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:985 | query work queued = 0, deferred = 0 , scan_time = 0.000s

Here is my input configuration:

[aws_cloudwatch://Cloudwatch_Local]
aws_account = Traverse
aws_region = ap-southeast-2
metric_dimensions = {"InstanceID" : "i-*"}
metric_names = ["CPUUtilization"]
metric_namespace = AWS/EC2
period = 60
polling_interval = 60
sourcetype = aws:cloudwatch
statistics = ["Average"]
index = aws_cloud
0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

pruned 0, queued 0, deferred 0, scan time 0... it's not seeing anything to do in that queue. Maybe wrong queue? Maybe blacklisting or filtering in some way? Maybe permissions?

View solution in original post

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

pruned 0, queued 0, deferred 0, scan time 0... it's not seeing anything to do in that queue. Maybe wrong queue? Maybe blacklisting or filtering in some way? Maybe permissions?

0 Karma

bhbritton
New Member

Was an issue with formatting...

metric_dimensions = [{"InstanceId":["i-.*"]}]
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...