we are ingested the aws vpc flow logs in splunk and able to see the data while searching with index but while searching with source it is not showing any data for that particular source.
for example: while using below search it is showing data.
1. index=* and able to see that source(aws:cloudwatch:vpclogs)
2. index=* | stats count by source , it is display the source(aws:cloudwatch:vpclogs) with 86 event counts.
but while searching with below command.
index=* source=aws:cloudwatch:vpclogs it is not displaying any data.
Then you need to check the default search indexes that are assigned to your user role. Probably the specific index you put the vpc logs into, is not included in the indexes searched by default (ie. when using index=*).
@renjith, I used the quotes but it is not working. index=test source="aws:guraddutty".
@Frank, I have access for that index and able to search other sources from that index.
It's not about whether you have access. There are 2 settings related to indexes in a user role:
I would check that second setting. Quite possible this is set to the default setting of 'main' (if I'm not mistaken), which means
index=* will only look in the main index, while your data is elsewhere. If you want to be able to search using
index=*, you need to make sure the Indexes searched by default are set to contain the indexes you want to search through.
I have cross checked that the particular source is storing the data in test index. but it is not working while searching data with that sources
I tried these command and it is not working.
Ok, now I'm getting confused.
In your question, you mentioned
source=aws:cloudwatch:vpclogs, now you are searching for another source?
Also: I think it should be
source=aws:guardduty, so with a single 't' in duty?
Just to prevent confusion over typo's in examples, can you provide a screenshot, showing the indexed data, showing the value of the source field. And then a second screenshot showing the search you are trying but fails?
Feel free to hide/obfuscate any sensitive info of course.