Getting Data In

Why in my ingest_time lookup - field does not show up?

PaulPanther
Builder

Hello colleagues,

we've implemented the ingest_time lookups but unfortunately the expected field from the configured csv-lookup does not show up in our searches.

Following implementation steps were executed:

1. props.conf & transforms.conf prepared and stored under $SPLUNK_HOME/etc/system/local on all indexer nodes within the cluster.
2. index_lookup.csv prepared and stored under $SPLUNK_HOME/etc/system/lookups on all indexer nodes within the cluster.
3. Rolling restart of the nodes
4. fields.conf prepared and deployed via SHD to our SHs

props.conf:

[aws:cloudwatch]
TRANSFORMS-define_index = define_rds_index

transforms.conf:

[define_rds_index]
INGEST_EVAL = test_index=json_extract(lookup("index_lookup.csv", json_object("account_id", account_id), json_array(index_tag)),"index_tag")

index_lookup.csv:

account_id index_tag
886089063862 index_platform-sandbox-dev

 

fields.conf:

[test_index]
INDEXED = True

 

Has anyone an idea if we missed a step or something is misconfigured? Thank you very much!

 

 

 

Labels (2)
0 Karma

bapun18
Communicator

Check the permissions of the lookup, if you have read permissions to the lookup, also check if this lookup has permission to view across apps.

0 Karma

PaulPanther
Builder

The lookup is set up on the indexer nodes.  Read and write permissions are  set.

0 Karma

somesoni2
Revered Legend

See if this makes any difference:

transforms.conf (adding double quotes around output field):

[define_rds_index]
INGEST_EVAL = test_index=json_extract(lookup("index_lookup.csv", json_object("account_id", account_id), json_array("index_tag")),"index_tag")
0 Karma

PaulPanther
Builder

@somesoni2 Thanks for your answer! Unfortunately it doesn't solve it.

Here is an example event:

{"Average": 4.975, "Maximum": 5.0, "Minimum": 4.95, "SampleCount": 2.0, "Sum": 9.95, "Unit": "Percent", "account_id": "886089063862", "metric_dimensions": "DBInstanceIdentifier=[aric664tyxxx]", "metric_name": "CPUUtilization", "period": 120, "timestamp": "2022-03-31T15:48:00Z"}
0 Karma

somesoni2
Revered Legend

Can you confirm (via running btool on your sourcetype) if you've INDEXED_EXTRACTION=json?

 

0 Karma

PaulPanther
Builder

Yes, correct. The parameter comes with the Splunk_TA_aws.

Tags (2)
0 Karma

PaulPanther
Builder

@somesoni2 Do we must disable the INDEXED_EXTRACTIONS and apply manually all parsing & formatting parameter?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...