All Apps and Add-ons

Splunk App for AWS: Why are auto-extracted fields not in the right format and how to fix this?

vaibhavagg2006
Communicator

I have some sample data from cloudtrail. But the auto-extracted fields are in the format "Records{}.* The app is not expecting "Records" keyword before the fieldname. What is the best way to rename all the fields in bulk without having need to change the queries.
Tried Field Alias from settings - "%22Records{}.%22*" AS "*" but its not working. I think this is due to extra quotes which splunk puts.

Please suggest a quicker way.

0 Karma

_d_
Splunk Employee
Splunk Employee

What view on the app are you specifically referring to? And, did you use the the Add-on here to grab this sample data: https://apps.splunk.com/app/1876/?

0 Karma

vaibhavagg2006
Communicator

Hi,
I have sample log files, I have not used the add-on to grab the data but I have installed the add-on and used the configurations of props.conf provided in this app for aws:cloudtrail . My issue is the fields I am getting as the auto extracted field in the fieldbar starts with "Records{}."
But When I see the pre built field aliases included in the add-on, the field names do not have "Records{}. suffixed. Also the field names used in the queries donot have "Records{}." I think i am missing any configuration which can be set to ignore the Records{} key in the log file.

0 Karma

ajaycitrus
New Member

You can install the Add-on. Then, ingest the static file using Data input option and assign the correct Sourcetype (which will appear once you install the Add-on) to parse the data.

0 Karma

_d_
Splunk Employee
Splunk Employee

You're not missing any configuration. You're just not using the Add-on which takes care of decomposing each record on its own event. Add-on's props and the App can understand all extraction based on that. I recommend you use the Add-on instead.

0 Karma

vaibhavagg2006
Communicator

oh..but i believe for using add-on i will need live aws instance. Actually I had to work on static logs for some proof of concept. Can I index static files using add-on?
Thank you for your inputs.

0 Karma
Get Updates on the Splunk Community!

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...