Getting Data In

Why in my ingest_time lookup - field does not show up?

PaulPanther
Builder

Hello colleagues,

we've implemented the ingest_time lookups but unfortunately the expected field from the configured csv-lookup does not show up in our searches.

Following implementation steps were executed:

1. props.conf & transforms.conf prepared and stored under $SPLUNK_HOME/etc/system/local on all indexer nodes within the cluster.
2. index_lookup.csv prepared and stored under $SPLUNK_HOME/etc/system/lookups on all indexer nodes within the cluster.
3. Rolling restart of the nodes
4. fields.conf prepared and deployed via SHD to our SHs

props.conf:

[aws:cloudwatch]
TRANSFORMS-define_index = define_rds_index

transforms.conf:

[define_rds_index]
INGEST_EVAL = test_index=json_extract(lookup("index_lookup.csv", json_object("account_id", account_id), json_array(index_tag)),"index_tag")

index_lookup.csv:

account_id index_tag
886089063862 index_platform-sandbox-dev

 

fields.conf:

[test_index]
INDEXED = True

 

Has anyone an idea if we missed a step or something is misconfigured? Thank you very much!

 

 

 

Labels (2)
0 Karma

bapun18
Communicator

Check the permissions of the lookup, if you have read permissions to the lookup, also check if this lookup has permission to view across apps.

0 Karma

PaulPanther
Builder

The lookup is set up on the indexer nodes.  Read and write permissions are  set.

0 Karma

somesoni2
Revered Legend

See if this makes any difference:

transforms.conf (adding double quotes around output field):

[define_rds_index]
INGEST_EVAL = test_index=json_extract(lookup("index_lookup.csv", json_object("account_id", account_id), json_array("index_tag")),"index_tag")
0 Karma

PaulPanther
Builder

@somesoni2 Thanks for your answer! Unfortunately it doesn't solve it.

Here is an example event:

{"Average": 4.975, "Maximum": 5.0, "Minimum": 4.95, "SampleCount": 2.0, "Sum": 9.95, "Unit": "Percent", "account_id": "886089063862", "metric_dimensions": "DBInstanceIdentifier=[aric664tyxxx]", "metric_name": "CPUUtilization", "period": 120, "timestamp": "2022-03-31T15:48:00Z"}
0 Karma

somesoni2
Revered Legend

Can you confirm (via running btool on your sourcetype) if you've INDEXED_EXTRACTION=json?

 

0 Karma

PaulPanther
Builder

Yes, correct. The parameter comes with the Splunk_TA_aws.

Tags (2)
0 Karma

PaulPanther
Builder

@somesoni2 Do we must disable the INDEXED_EXTRACTIONS and apply manually all parsing & formatting parameter?

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...