Splunk Cloud Platform

Microsoft Azure App for Splunk

monguyen
New Member

Hi, 

This photo includes the SPL search for the Microsoft Azure App for Splunk in the Billing Overview:

monguyen_0-1622052635019.png

This search no longer results in any events because the properties.pretaxCost and properties.usageQuantity fields no longer exist if I search:

index=item_prod_event_azure_90d OR index=cyber_prod_event_mscloud_1y sourcetype="azure:billing".

monguyen_1-1622053022658.png

 

Additionally, the fields seen in the following line also do not show up as fields any longer as well:

| dedup properties.usageStart properties.instanceId properties.meterDetails.meterSubCategory Cost properties.meterDetails.meterName Quantity

What can be done to view the billing information again?

Thanks so much! 

Labels (1)
0 Karma

monguyen
New Member

Good point. It does seem it could have been renamed.

Would it be possible to know what the fields have been renamed as to make sure I am pulling the correct information? Or who I can contact to check this? The ones that I am still unsure about are the properties.usageStart and properties.instanceId. I think it could be properties.date and properties.meterId, respectively, but it would be good for someone who changed the fields to confirm this. Thank you! 

0 Karma

dmacintosh_splu
Splunk Employee
Splunk Employee

The screenshot of the fields you shared contains the properties.cost and properties.quantity fields. Do the field values represent the data you want?

It is possible that Azure changed the name of the fields in the raw data.

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...