All Apps and Add-ons

Splunk App for AWS: Why are auto-extracted fields not in the right format and how to fix this?

vaibhavagg2006
Communicator

I have some sample data from cloudtrail. But the auto-extracted fields are in the format "Records{}.* The app is not expecting "Records" keyword before the fieldname. What is the best way to rename all the fields in bulk without having need to change the queries.
Tried Field Alias from settings - "%22Records{}.%22*" AS "*" but its not working. I think this is due to extra quotes which splunk puts.

Please suggest a quicker way.

0 Karma

_d_
Splunk Employee
Splunk Employee

What view on the app are you specifically referring to? And, did you use the the Add-on here to grab this sample data: https://apps.splunk.com/app/1876/?

0 Karma

vaibhavagg2006
Communicator

Hi,
I have sample log files, I have not used the add-on to grab the data but I have installed the add-on and used the configurations of props.conf provided in this app for aws:cloudtrail . My issue is the fields I am getting as the auto extracted field in the fieldbar starts with "Records{}."
But When I see the pre built field aliases included in the add-on, the field names do not have "Records{}. suffixed. Also the field names used in the queries donot have "Records{}." I think i am missing any configuration which can be set to ignore the Records{} key in the log file.

0 Karma

ajaycitrus
New Member

You can install the Add-on. Then, ingest the static file using Data input option and assign the correct Sourcetype (which will appear once you install the Add-on) to parse the data.

0 Karma

_d_
Splunk Employee
Splunk Employee

You're not missing any configuration. You're just not using the Add-on which takes care of decomposing each record on its own event. Add-on's props and the App can understand all extraction based on that. I recommend you use the Add-on instead.

0 Karma

vaibhavagg2006
Communicator

oh..but i believe for using add-on i will need live aws instance. Actually I had to work on static logs for some proof of concept. Can I index static files using add-on?
Thank you for your inputs.

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...