Splunk Add-on for Amazon Web Services: Why am I unable to connect and pull metrics from Cloudwatch?

[bhbritton]

Having issues pulling back metrics from Cloudwatch. There are a number of running instances with metrics I should be able to retrieve. I have also been able to retrieve this from other monitoring applications.

Here is what I am getting in the log.

2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:890 | STARTED: 
2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:prune:159 | Checkpointer pruned 0 of 0 items leaving 0 items.
2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:__init__:65 | Checkpointer recovered from C:\Program Files\Splunk\var\lib\splunk\modinputs\aws_cloudwatch
2015-12-04 15:50:20,296 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:get_access_key_pwd_real:773 | get account name: Traverse
2015-12-04 15:50:22,391 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:_expand_stanza_metrics:839 | Getting account ID from user arn splitted by ":".
2015-12-04 15:50:25,451 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:931 | input_name: [aws_cloudwatch://Cloudwatch_Local] metric_count: 0
2015-12-04 15:50:25,451 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:937 | total_metric_count: 0
2015-12-04 15:50:25,451 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:__init__:72 | Checkpointer initialized from wait queue
2015-12-04 15:50:25,457 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:save:140 | Checkpointer saved 0 items in 0.006000 seconds to: C:\Program Files\Splunk\var\lib\splunk\modinputs\aws_cloudwatch\checkpointer.json
2015-12-04 15:50:25,460 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:985 | query work queued = 0, deferred = 0 , scan_time = 0.000s
2015-12-04 15:51:01,480 INFO pid=13108 tid=MainThread file=aws_cloudwatch.py:stream_events:985 | query work queued = 0, deferred = 0 , scan_time = 0.000s

Here is my input configuration:

[aws_cloudwatch://Cloudwatch_Local]
aws_account = Traverse
aws_region = ap-southeast-2
metric_dimensions = {"InstanceID" : "i-*"}
metric_names = ["CPUUtilization"]
metric_namespace = AWS/EC2
period = 60
polling_interval = 60
sourcetype = aws:cloudwatch
statistics = ["Average"]
index = aws_cloud

[jcoates_splunk · Accepted solution]

pruned 0, queued 0, deferred 0, scan time 0... it's not seeing anything to do in that queue. Maybe wrong queue? Maybe blacklisting or filtering in some way? Maybe permissions?

[bhbritton]

Was an issue with formatting...

metric_dimensions = [{"InstanceId":["i-.*"]}]