a couple of suggestions:
try looking in the billing app's log file for any errors. it is located in
//$SPLUNK_HOME/etc/apps/SplunkAppforAWSBilling/log/detailed_bill_errors.txt
this app normally pulls logs for the current month only. you can tell it to pull/process logs for previous months and then see if the index aws-bill gets populated (this is what solved the problem for me). use the helper scripts located under //$SPLUNK__HOME/etc/apps/SplunkAppforAWSBilling/bin:
fetch_older_report.py 2014 08
(this will pull the report for August 2014).
followed by:
process_older_report.py 2014 08
(process the report for August 2014).
running these scripts will poplate the index with older data that you fetched.
another problem could be with file naming: I had to fix the script fetch_older_report.py because it looked for files ending with .csv.zip instead of .zip. I changed line 78 from:
blah blah blah +".csv.zip"
to
blah blah blah +".zip"
I hope that helps.
don't forget to restart Splunk after you make these changes!
... View more