About czhang_splunk

czhang_splunk · ‎10-20-2016

That's interesting. I removed the "sourcetype="aws:description" in both of my searches, and I got the very similar results as yours. Could you please try to limit your result set a lit bit and try again? For example, add sourcetype="foo" and make sure all events has msg field? Thanks for your time!

czhang_splunk · ‎10-20-2016

I have two searches return the same result in my single Splunk instance environment, but there is huge performance different between two searches. Searches: 1. index=main sourcetype="aws:description" placement="us-west-2*" 2. index=main sourcetype="aws:description" | where like(placement, "us-west-2%") Results: 1. This search has completed and has returned 2,013 results by scanning 36,909 events in 35.372 seconds. 2. This search has completed and has returned 2,013 results by scanning 561,295 events in 11.913 seconds. The raw events are in JSON format. placement field has the values of us-west-2a, us-west-2b, and us-west-2c. The performance gap becomes even larger if there is larger data set. Could anyone explain why wildcard search is much slower? Is it always best practice to use where + like? Thanks! UDPATE Thank everyone for the help. Figured out the reason by reading http://conf.splunk.com/sessions/2016-sessions.html#search=fields%2C%20indexed%20tokens%20and%20you&

czhang_splunk · ‎05-02-2016

Hi Sankar74, The Overview page has been updated on Splunk App for AWS - 4.1.1, which removed the usage of macro aws-description-instance . I guess you have edited the Overview page when you have App 4.0.0 installed, is that correct? In that case there will be a copy of old Overview page under APP FOLDER/local/data/ui/views/overview.xml . You can make a copy of your old overview.xml and delete it. Then you will be available to view the latest Overview page. Let me know if this solves your problem. Thanks!

czhang_splunk · ‎04-21-2016

Hi asbet, For your question 2, could you please just click on the number (55) to drilldown to the search to see what 55 users are? Thanks

czhang_splunk · ‎04-11-2016

hi r1tual, could you please double check whether you have configured AWS Config in App? If so, there should be some events with sourcetype="aws:config:notification". Every time you create/delete/modify the resource in AWS, there will be a aws:config:notification event logged the diff of your modification.

czhang_splunk · ‎04-11-2016

Would you please mark this as the answer? Thanks!

czhang_splunk · ‎04-10-2016

hi r1tual, could you please double check whether you have configured AWS Config in App? If so, there should be some events with sourcetype="aws:config:notification". Every time you create/delete/modify the resource in AWS, there will be a aws:config:notification event logged the diff of your modification.

czhang_splunk · ‎04-09-2016

Is that OK to use AWS Config Notification to monitor the SG changes? Basically you can use sourcetype="aws:config:notification" "configurationItem.resourceType"="AWS::EC2::SecurityGroup" to detect whether there is any update of SGs.

czhang_splunk · ‎12-22-2015

Hi cmeo, Basically when you add an AWS account in Configure page of AWS App, the account id will be written into all_account_ids.csv. Have you seen any error when adding AWS account? A quick and dirty workaround is: go to lookup folder under app dictionary and edit all_account_ids.csv manually. The file format should be: > name,account_id > [your AWS account friendly name],[12-digit AWS account ID] An example: > name,account_id > Calvin,000000000000 It would be great if you could go to Splunk/var/log/splunk/saas_app_aws.log to see if there is any error related to aws_account_manager.py Hope this helps! Thanks!

czhang_splunk · ‎11-23-2015

Hi, thank you for the feedback! I have tested it on both 6.2.2 and 6.2.7. It works on 6.2.7, but broken on 6.2.2 😞 So I would say it is a bug on 6.2.2

czhang_splunk · ‎11-18-2015

Hi Madan, Are your EBS volumes in a single AWS region or they are in multi regions? If they are in more than one regions, then you have to configure AWS Config for each region in the AWS App. Let me know if it solves your question. Thanks!

Posts	11
Solutions	2
Karma Given	2
Karma Received	4
Member Since	‎08-20-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Why wildcard search is much slower than "where lik...

Re: Why wildcard search is much slower than "where...

Why wildcard search is much slower than "where lik...

Re: Splunk App for AWS: How do I resolve error "Th...

Re: IAM Activity, User Activity, CloudTrail API Ac...

Re: Splunk App for AWS: How to create an alert to ...

Re: Splunk App for AWS: How to create an alert to ...

Re: Splunk App for AWS: How to create an alert to ...

Re: Splunk App for AWS: How to create an alert to ...

Re: Splunk App for AWS: Why is all_account_ids.csv...

Re: Possible incorrect lookup statement in Splunk ...

Re: Splunk App for AWS not pulling all Volume reso...