All Apps and Add-ons

Why is AWS Billing failing with "there's no any timestamp column in header" after moving the Splunk App for AWS from the search head to the heavy forwarder?

cwyse
Explorer

We configured AWS billing on the aws app. Things worked fine until we moved the app from the search head to the heavy forwarder. Now we are seeing a lot of failures with the following error:

  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_billing.py", line 896, in _stream_monthly_billing_item
    raise Exception("there's no any timestamp column in header")
Exception: there's no any timestamp column in header

I copied the inputs over from the working system so nothing should have changed. I do see the errors on existing files. So I'm not sure why it can't find the timestamp anymore.

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

following up from offline conversation -- the default conf files needed to be copied over too.

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

following up from offline conversation -- the default conf files needed to be copied over too.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...