Hi
We have configured Splunk Enterprise on a single server with inputs for ELB. We use a classic ELB and have inputs for ELB via Cloudwatch and via ELB access logs (SQS based S3). The ELB dashboard window for 'Requests by ELB' is blank. When looking at the search query it is highlighting the last 2 pipes below as failing.
search (metric_dimensions!="*],*" aws_account_id="*" eventtype="aws_cloudwatch_elb_events" metric_dimensions="LoadBalancer*" metric_name=RequestCount region="" sourcetype="aws:cloudwatch" (index="default" OR index="main")) | rex field=metric_dimensions "([ ,]|^)LoadBalancer=\[app/(?.*?)/" | lookup regions region | eval uniq_label=(((((name . " (") . account_id) . ", ") . location) . ")") | stats sum(Sum) as count by uniq_label | rename uniq_label as "ELB Name"
I have removed the entry from RequestCount region "" for privacy but everything else is how the search string looks. If we replace 'stats sum(Sum) as count by uniq_label | rename uniq_label as "ELB Name"' with 'stats sum(Sum) as count by metric_dimensions' it then displays the pie chart with a breakdown of each of our ELBs. However, if we then drill in further to each ELB from the chart we get similar failures so it looks like amending the search string for the dashboard is not an option without further breaking the drill down areas. I think the issue lays somewhere around the 'eval uniq_label' as one of the messages shown when inspecting the search is 'verify that the fields expected by the report commands are present in the events' but I'm not sure how or where to check or change this.
For info we have added the required metadata inputs and enabled the 'Addon Metadata - Summarize AWS Inputs' saved search. http://docs.splunk.com/Documentation/AWS/5.1.0/Installation/Metadata Any help would be appreciated.
Thanks
↧