All Apps and Add-ons

vpc_flow_logs_traffic and vpc_flow_logs_security dashboards not populating

yannK
Splunk Employee
Splunk Employee

I collect my vpc logs using the aws addon :
sourcetype=aws:cloudwatchlogs:vpcflow
index=myvpclogs
I can see the data in my index.

but my dashboards in the aws app on the vpc logs do not populate : vpc_flow_logs_traffic and vpc_flow_logs_security
look like the search is looking for data in index=aws_vpc_flow_logs

Tags (1)
1 Solution

yannK
Splunk Employee
Splunk Employee

The problem was my custom index

  • I was collecting vpc logs in the index myvpclogs
  • 3 scheduled summary searches are searching for the sourcetype aws:cloudwatchlogs:vpcflow and generate summarized data in the index=aws_vpc_flow_logs
  • the VPC dashboard are populated by a search looking in a summary index=aws_vpc_flow_logs

Because my index was custom and not searched by default, the summary search didn't see my data.
The workaround was to edit the macro aws-vpc-flow-sourcetype to add the index list in a condition. "index=myvpclogs"
Then the summary searches are now able to see the data, and the dashboard populates.

View solution in original post

dandu1008
New Member

Hi yannk,

I am stuck with exact same issue, could you please give the detail steps how you resolved this.
But I have not given any custom index name, I've chosen default as index. I able to query data in search but data is not populating in VPC security dashboards.
Where do I need change configurations?

0 Karma

p_gurav
Champion

Try changing summary searches with your default index.

0 Karma

yannK
Splunk Employee
Splunk Employee

Have you edited the macro to add the index in it as a condition ?

The workaround was to edit the macro aws-vpc-flow-sourcetype to add the index list in a condition. "index=myvpclogs"

0 Karma

yannK
Splunk Employee
Splunk Employee

The problem was my custom index

  • I was collecting vpc logs in the index myvpclogs
  • 3 scheduled summary searches are searching for the sourcetype aws:cloudwatchlogs:vpcflow and generate summarized data in the index=aws_vpc_flow_logs
  • the VPC dashboard are populated by a search looking in a summary index=aws_vpc_flow_logs

Because my index was custom and not searched by default, the summary search didn't see my data.
The workaround was to edit the macro aws-vpc-flow-sourcetype to add the index list in a condition. "index=myvpclogs"
Then the summary searches are now able to see the data, and the dashboard populates.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!