- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Current Month Estimated Billing not displaying...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Current Month Estimated Billing not displaying Account ID in drop-down
Unable to get billing details in Splunk App for AWS. I have configured the billing input in Splunk Add-on apps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
do you have billing data?
https://docs.splunk.com/Documentation/AddOns/released/AWS/ConfigureAWS#Configure_billing
try and search index = * sourcetype = aws:billing OR sourcetype = aws:billing:cur
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, I already did this step. I am getting the search results in Splunk Add-on App. But its not displaying in the same data in my Splunk App for AWS.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
did you verify the search returned results?
what index does the data sits in?
does your user role searches that index by default?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, this is my search criteria : index = "main" sourcetype = "aws:billing" OR sourcetype = "aws:billing:cur"
and this is the results:
4,417 events (7/1/18 12:00:00.000 AM to 7/19/18 6:21:58.000 PM)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
But when I go to Splunk App for AWS -> Billing. It does not produces any search results nor does it populate my Account Id
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for your help.. I figured the issue.. My AWS reports configuration was not proper.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
