Splunk Enterprise

Getting aws:metadata in Splunk Add-on for AWS but not reflecting Splunk App for AWS

nikhilmfwd
Path Finder

hi team,

Getting aws : metadata in Splunk Add-on for AWS but not reflecting Splunk App for AWS.

I ensured by mentioned things that data is reflecting properly & indexing also.

  1. Ensure the metadata is being collected: First, check that the metadata is actually being collected by the Splunk Add-on for AWS. You can do this by searching for the data using the Splunk search language. For example, you can try running a search like this:

    index=* sourcetype=aws:metadata

    If you see results from this search, it means that the metadata is being collected and indexed by Splunk.

    1. Check that the metadata is being forwarded: If the metadata is being collected by the Splunk Add-on for AWS but not showing up in the Splunk App for AWS, it's possible that it's not being properly forwarded from the indexer to the search head. Check that the data is being forwarded by running the following search:

      index=* sourcetype=aws:metadata | stats count by sourcetype

      If you see a non-zero count for aws:metadata, it means that data is being forwarded.

      1. Check that the metadata is being indexed: If the metadata is being collected and forwarded, but still not showing up in the Splunk App for AWS, it's possible that it's not being properly indexed. You can check this by running the following search:

        index=* sourcetype=aws:metadata | table _raw

        If you see data in the _raw field, it means that the data is being indexed properly.

    Screenshot 2023-05-05 at 2.50.28 PM.pngScreenshot 2023-05-05 at 2.49.55 PM.pngScreenshot 2023-05-05 at 2.49.12 PM.png

Labels (2)
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...