All Apps and Add-ons

Splunk App for AWS: Why are auto-extracted fields not in the right format and how to fix this?

vaibhavagg2006
Communicator

I have some sample data from cloudtrail. But the auto-extracted fields are in the format "Records{}.* The app is not expecting "Records" keyword before the fieldname. What is the best way to rename all the fields in bulk without having need to change the queries.
Tried Field Alias from settings - "%22Records{}.%22*" AS "*" but its not working. I think this is due to extra quotes which splunk puts.

Please suggest a quicker way.

0 Karma

_d_
Splunk Employee
Splunk Employee

What view on the app are you specifically referring to? And, did you use the the Add-on here to grab this sample data: https://apps.splunk.com/app/1876/?

0 Karma

vaibhavagg2006
Communicator

Hi,
I have sample log files, I have not used the add-on to grab the data but I have installed the add-on and used the configurations of props.conf provided in this app for aws:cloudtrail . My issue is the fields I am getting as the auto extracted field in the fieldbar starts with "Records{}."
But When I see the pre built field aliases included in the add-on, the field names do not have "Records{}. suffixed. Also the field names used in the queries donot have "Records{}." I think i am missing any configuration which can be set to ignore the Records{} key in the log file.

0 Karma

ajaycitrus
New Member

You can install the Add-on. Then, ingest the static file using Data input option and assign the correct Sourcetype (which will appear once you install the Add-on) to parse the data.

0 Karma

_d_
Splunk Employee
Splunk Employee

You're not missing any configuration. You're just not using the Add-on which takes care of decomposing each record on its own event. Add-on's props and the App can understand all extraction based on that. I recommend you use the Add-on instead.

0 Karma

vaibhavagg2006
Communicator

oh..but i believe for using add-on i will need live aws instance. Actually I had to work on static logs for some proof of concept. Can I index static files using add-on?
Thank you for your inputs.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...