Splunk for AWS issues - No Billing

[ICTMoretonbay]

Was wondering if someone out there can offer up some help or assistance.

Can't get billing working no matter what I try. Some EBS volume and snapshot data retrieved ok but no bills/usage data. All I get is "No result found"

I have also created an IAM user with specific permissions under the master account without luck.
I have enabled IAM access to Billing info in AWS account settings

The aws.conf file looks like this.... and I have added some notes:

---

all this three stanzas are required, in order to run AWS App.

[keys]

At least one entry required for this stanza

111111111111 = MasterCompany XXXXXXXXXXX YYYYYYYYYYYYYYYYYYYY ---- This access key/secret crated when logged in as Master Account in the “Your Security Credentials” section

All the below sub accounts appear in the master company consolidated billing section and are linked and I have logged into each sub account individually to create their own access keys and secrets.

222222222222 = SubAccount_A AAAAAAAAAAAA BBBBBBBBBBBBBBBBBB

333333333333 = SubAccount_B BBBBBBBBBBBBB CCCCCCCCCCCCCCCCC

444444444444 = SubAccount_C CCCCCCCCCCCCC DDDDDDDDDDDDDDDDD

555555555555 = SubAccount_D DDDDDDDDDDD EEEEEEEEEEEEEEEEEEEE

[regions]

At least one entry required for this stanza
rgn8 = ap-southeast-2 -- my region

[misc]

corpkey = MasterCompany XXXXXXXXXXX YYYYYYYYYYYYYYYYYYYY ---same as above in keys section

acno is corp account number for AWS
acno = 111111111111 - this appears in the billing csv as the [PayerAccountId]

s3bucket is bucket name where AWS bill csv files will be dropped

s3bucket = splunkapi_bucket --- reports appear here correctly with sub accounts
(combined billing with correct [LinkedAccountId] that match the above sub accounts )
... Master Company user can manually view and download files.

---

In the Splunk for AWS apps log dir I see correct info for my instance type etc. in the c1.txt file
errors1.txt = no entries
errors.txt = no current entry although full of info from all my previous attempts. but mainly has these lines..

01-09-2014 09:19:28 E. Australia Standard Time 111111111111 ap-southeast-2 --ops-3--

Really stuck here and am obviously missing something.

[apmit]

I'm having a very similar issue.

I see the billing csv file.
My S3 bucket is all lower case.
My S3 bucket matches what I've put in local/aws.conf.

When I run get_bill.py, I receive the following error:

Traceback (most recent call last):

File "./get_bill.py", line 4, in ?
import os, sys, boto.ec2, calendar, datetime,time, ConfigParser,
boto, csv File
"/opt/splunk/etc/apps/SplunkAppforAWS/bin/boto/init.py",
line 28, in ?
from boto.storage_uri import BucketStorageUri, FileStorageUri

File
"/opt/splunk/etc/apps/SplunkAppforAWS/bin/boto/storage_uri.py",
line 27, in ?
from boto.s3.deletemarker import DeleteMarker File
"/opt/splunk/etc/apps/SplunkAppforAWS/bin/boto/s3/init.py",
line 52
from .connection import S3Connection
^ SyntaxError: invalid syntax

When I look at /opt/splunk/etc/apps/SplunkAppforAWS/bin/boto/s3/init.py line 52:

*def regions():
"""
Get all available regions for the Amazon S3 service.

:rtype: list
:return: A list of :class:`boto.regioninfo.RegionInfo`
"""
from .connection import S3Connection
return [S3RegionInfo(name='us-east-1',
                     endpoint='s3.amazonaws.com',
                     connection_cls=S3Connection),*

Is there a typo at the ".connection" line?
Changing the line to:

• from connection import S3Connection*

Resolves the error. But, then there's a further error with boto ec2:

Traceback (most recent call last):
File "./get_bill.py", line 4, in ?
import os, sys, boto.ec2, calendar, datetime,time, ConfigParser, boto, csv
File "/opt/splunk/etc/apps/SplunkAppforAWS/bin/boto/ec2/init.py", line 26, in ?
from boto.ec2.connection import EC2Connection
File "/opt/splunk/etc/apps/SplunkAppforAWS/bin/boto/ec2/connection.py", line 3452
'true' if enable_dns_support else 'false')
^
SyntaxError: invalid syntax

Maybe the Splunk App for AWS needs an update to the version of boto packaged with it?

Downloading the latest boto and replacing the one installed with the app resolved this issue.

[ICTMoretonbay]

Ok I have my problem solved.

I'm running Splunk on windows, this app is for Linux.

🙂

[ICTMoretonbay]

Yes I see billing csv under s3 bucket folder

no, all lower case

yes same in aws.conf

When I run get_bill.py I get:

ImportError: No module named site

[nkhetia]

Could you check following :

• do you see billing csv file under s3 bucket folder ?
• S3 bucket name have any uppercase letters ?
• is physical S3 bucket name identical with aws.conf ?

you can also run following command manually and see if there is any output on the screen:

$SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/SplunkAppforAWS/bin/get_bill.py

thanks

Nilesh