Splunk App for AWS: Why are auto-extracted fields not in the right format and how to fix this?

[vaibhavagg2006]

I have some sample data from cloudtrail. But the auto-extracted fields are in the format "Records{}.* The app is not expecting "Records" keyword before the fieldname. What is the best way to rename all the fields in bulk without having need to change the queries.
Tried Field Alias from settings - "%22Records{}.%22*" AS "*" but its not working. I think this is due to extra quotes which splunk puts.

Please suggest a quicker way.

[_d_]

What view on the app are you specifically referring to? And, did you use the the Add-on here to grab this sample data: https://apps.splunk.com/app/1876/?

[vaibhavagg2006]

Hi,
I have sample log files, I have not used the add-on to grab the data but I have installed the add-on and used the configurations of props.conf provided in this app for aws:cloudtrail . My issue is the fields I am getting as the auto extracted field in the fieldbar starts with "Records{}."
But When I see the pre built field aliases included in the add-on, the field names do not have "Records{}. suffixed. Also the field names used in the queries donot have "Records{}." I think i am missing any configuration which can be set to ignore the Records{} key in the log file.

[ajaycitrus]

You can install the Add-on. Then, ingest the static file using Data input option and assign the correct Sourcetype (which will appear once you install the Add-on) to parse the data.

[_d_]

You're not missing any configuration. You're just not using the Add-on which takes care of decomposing each record on its own event. Add-on's props and the App can understand all extraction based on that. I recommend you use the Add-on instead.

[vaibhavagg2006]

oh..but i believe for using add-on i will need live aws instance. Actually I had to work on static logs for some proof of concept. Can I index static files using add-on?
Thank you for your inputs.