All Apps and Add-ons

Splunk App for AWS: Why are ELBs not appearing in the Traffic Analysis Dashboard?

klaxdal
Contributor

Seem to have an issue with the ELB - Traffic Analysis Dashboard on the Splunk App for AWS - only two ELBs show up when the search runs .

  1. I have verified that all the logs are being indexed into Splunk
  2. The two that appear in the dashboard seem to have the field "elb" in the events
  3. The remaining ELB's do not have this field and don't appear in the dashboard although the sourcetype=aws:elb:accesslogs is correct and the data is indexing .

Any ideas what the issue might be ? Any ideas why the elb field is missing for the other inputs ? All of them ( 12 in total ) are configured the same way .
alt text

0 Karma
1 Solution

klaxdal
Contributor

Found the solution - had to "manually" extract the fields - for some reason the Regex within props.conf did not work 😞

View solution in original post

0 Karma

aaguirr1
New Member

Are you using splunkcloud?
Regards,
Arsenio

0 Karma

klaxdal
Contributor

Arsenio ,

I am using Splunk Enterprise . Turns out the Filed Extracts were not correctly extracting the field "elb" ( amongst others )

Rewriting the regex in props.conf fixed this issue

0 Karma

klaxdal
Contributor

Found the solution - had to "manually" extract the fields - for some reason the Regex within props.conf did not work 😞

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...