Getting Data In

Why in my ingest_time lookup - field does not show up?

PaulPanther
Motivator

Hello colleagues,

we've implemented the ingest_time lookups but unfortunately the expected field from the configured csv-lookup does not show up in our searches.

Following implementation steps were executed:

1. props.conf & transforms.conf prepared and stored under $SPLUNK_HOME/etc/system/local on all indexer nodes within the cluster.
2. index_lookup.csv prepared and stored under $SPLUNK_HOME/etc/system/lookups on all indexer nodes within the cluster.
3. Rolling restart of the nodes
4. fields.conf prepared and deployed via SHD to our SHs

props.conf:

[aws:cloudwatch]
TRANSFORMS-define_index = define_rds_index

transforms.conf:

[define_rds_index]
INGEST_EVAL = test_index=json_extract(lookup("index_lookup.csv", json_object("account_id", account_id), json_array(index_tag)),"index_tag")

index_lookup.csv:

account_id index_tag
886089063862 index_platform-sandbox-dev

 

fields.conf:

[test_index]
INDEXED = True

 

Has anyone an idea if we missed a step or something is misconfigured? Thank you very much!

 

 

 

Labels (2)
0 Karma

bapun18
Communicator

Check the permissions of the lookup, if you have read permissions to the lookup, also check if this lookup has permission to view across apps.

0 Karma

PaulPanther
Motivator

The lookup is set up on the indexer nodes.  Read and write permissions are  set.

0 Karma

somesoni2
Revered Legend

See if this makes any difference:

transforms.conf (adding double quotes around output field):

[define_rds_index]
INGEST_EVAL = test_index=json_extract(lookup("index_lookup.csv", json_object("account_id", account_id), json_array("index_tag")),"index_tag")
0 Karma

PaulPanther
Motivator

@somesoni2 Thanks for your answer! Unfortunately it doesn't solve it.

Here is an example event:

{"Average": 4.975, "Maximum": 5.0, "Minimum": 4.95, "SampleCount": 2.0, "Sum": 9.95, "Unit": "Percent", "account_id": "886089063862", "metric_dimensions": "DBInstanceIdentifier=[aric664tyxxx]", "metric_name": "CPUUtilization", "period": 120, "timestamp": "2022-03-31T15:48:00Z"}
0 Karma

somesoni2
Revered Legend

Can you confirm (via running btool on your sourcetype) if you've INDEXED_EXTRACTION=json?

 

0 Karma

PaulPanther
Motivator

Yes, correct. The parameter comes with the Splunk_TA_aws.

Tags (2)
0 Karma

PaulPanther
Motivator

@somesoni2 Do we must disable the INDEXED_EXTRACTIONS and apply manually all parsing & formatting parameter?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...