All Apps and Add-ons

Splunk App for AWS: Why is all_account_ids.csv not being created?


It's all in the question 🙂 The app is otherwise up and running quite happily, but allaccountids.csv did not get created and every input that uses it shows 'Search produced no results'. This is fine as long as I have only one account active, but soon I'll have more.

It seems to me that is supposed to create it, but doesn't. Anyone seen this problem before, and what can I do about it? Manually create with Lookup Editor, or some other way?


0 Karma

Splunk Employee
Splunk Employee

AWS app tries to fill AWS account ID every time when you are in configure page and the account ID is empty. You can try the following steps:

  1. Open splunkappaws/configure page, check if "Account ID" has value.
  2. If not, check allaccountids.csv in "lookup" folder to see if it records your account ID.
  3. It should record your ID, otherwise, you can check splunkd.log and saasappaws.log to see if any exceptions popped.

If no account ID and error has been found, you can try to add it manually. You follow steps as czhang posted.

0 Karma

Splunk Employee
Splunk Employee

Hi cmeo,

Basically when you add an AWS account in Configure page of AWS App, the account id will be written into allaccountids.csv. Have you seen any error when adding AWS account?

A quick and dirty workaround is: go to lookup folder under app dictionary and edit allaccountids.csv manually.
The file format should be:

> name,account_id
> [your AWS account friendly name],[12-digit AWS account ID]

An example:

> name,account_id
> Calvin,000000000000

It would be great if you could go to Splunk/var/log/splunk/saasappaws.log to see if there is any error related to

Hope this helps! Thanks!