All Apps and Add-ons

Splunk and AWS CloudFront data

cmutt78
Explorer

I am attempting to setup a CloudFront data input using the Splunk app for AWS. My steps thus far:
- Create/Use a distribution accessible through the AWS console
- Turn on logging for the distribution and assign to an s3 bucket
- Create the data input input in splunk

AWS account: <selected mine>
AWS region: us-east-1
Metric namespace: AWS/CloudFront
Metric Names: ["Requests","BytesDownloaded","BytesUploaded","TotalErrorRate","4xxErrorRate","5xxErrorRate"]
Dimension Names: [{"DistributionId":"E1GGN2SAMEXDYG", "Region":"Global"}]
Metric stats: ["Average", "Sum", "SampleCount", "Maximum", "Minimum"]
Granularity: 60 (I've tried 3600 as well)
Polling: 60 (I've tried 3600 as well)

Based on everything I have seen, this should work but can't find one good example that shows successful capture of the CloudFront data.

Please advise.

0 Karma

rarsan_splunk
Splunk Employee
Splunk Employee

Related to this:
You may want to refer to the following on how to onboard raw AWS CloudFront logs to Splunk:
http://answers.splunk.com/answers/311972/aws-cloudfront.html#answer-315294

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

what do you see on this search?

index=_internal sourcetype=aws:cloudwatch:log
0 Karma

cmutt78
Explorer

What I decided to do was to bypass the Metrics and pull the raw data from the s3 bucket. Figured that the metrics would be easy enough to replicate.

0 Karma

cmutt78
Explorer

I see the below in several different variations with #'s of metrics and failures

2015-07-21 02:21:01,671 INFO pid=10489 tid=QueryWorkerThread-2 file=aws_cloudwatch.py:_main_work_loop:582 | Queried 2 metrics with 2 failures totaling 0 statistics in 0.439s before stalling.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

ah, interesting... that means that the notifications are showing up in SQS, but the parsing process doesn't recognize them (or potentially the s3 files that the notifications point to). Support case and diag are the next steps. Is this a multiple account setup?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...