All Apps and Add-ons

Splunk Add-on for Amazon Web Services: Why am I unable to connect and pull metrics from Cloudwatch?

bhbritton
New Member

Having issues pulling back metrics from Cloudwatch. There are a number of running instances with metrics I should be able to retrieve. I have also been able to retrieve this from other monitoring applications.

Here is what I am getting in the log.

2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:890 | STARTED: 
2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:prune:159 | Checkpointer pruned 0 of 0 items leaving 0 items.
2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:__init__:65 | Checkpointer recovered from C:\Program Files\Splunk\var\lib\splunk\modinputs\aws_cloudwatch
2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:get_access_key_pwd_real:773 | get account name: Traverse
2015-12-04 15:50:22,391 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:_expand_stanza_metrics:839 | Getting account ID from user arn splitted by ":".
2015-12-04 15:50:25,451 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:931 | input_name: [aws_cloudwatch://Cloudwatch_Local] metric_count: 0
2015-12-04 15:50:25,451 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:937 | total_metric_count: 0
2015-12-04 15:50:25,451 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:__init__:72 | Checkpointer initialized from wait queue
2015-12-04 15:50:25,457 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:save:140 | Checkpointer saved 0 items in 0.006000 seconds to: C:\Program Files\Splunk\var\lib\splunk\modinputs\aws_cloudwatch\checkpointer.json
2015-12-04 15:50:25,460 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:985 | query work queued = 0, deferred = 0 , scan_time = 0.000s
2015-12-04 15:51:01,480 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:985 | query work queued = 0, deferred = 0 , scan_time = 0.000s

Here is my input configuration:

[aws_cloudwatch://Cloudwatch_Local]
aws_account = Traverse
aws_region = ap-southeast-2
metric_dimensions = {"InstanceID" : "i-*"}
metric_names = ["CPUUtilization"]
metric_namespace = AWS/EC2
period = 60
polling_interval = 60
sourcetype = aws:cloudwatch
statistics = ["Average"]
index = aws_cloud
0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

pruned 0, queued 0, deferred 0, scan time 0... it's not seeing anything to do in that queue. Maybe wrong queue? Maybe blacklisting or filtering in some way? Maybe permissions?

View solution in original post

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

pruned 0, queued 0, deferred 0, scan time 0... it's not seeing anything to do in that queue. Maybe wrong queue? Maybe blacklisting or filtering in some way? Maybe permissions?

0 Karma

bhbritton
New Member

Was an issue with formatting...

metric_dimensions = [{"InstanceId":["i-.*"]}]
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...