All Apps and Add-ons

Splunk Add-on for Amazon Web Services: Why are fields appearing with Records{} prefix?

chanmic
New Member

Hi All,

I have installed the Splunk Add-on for AWS and I am able to ingest S3 logs into Splunk, but the dashboards are not working. When I look at the fields, I can see a lot of them are appearing with a pre-fix of Records{}. E.g., Records{}.requestID, Records{}.eventType etc...

I believe this is affecting the search. I don't see any errors in the log

Has anyone experienced this? I am hoping someone can point me to the right direction to fix it.

Cheers,
Michael.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, IIRC that's the format that you get from CloudTrail when there are multiple accounts writing into one bucket (http://docs.splunk.com/Documentation/AddOns/latest/AWS/ConfigureInputs#CloudTrail_inputs) -- newer versions of the Add-on should parse those records, but an older version would leave the records wrapper on.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...