Hi Folks; So Hopefully I have the blessing of the folks from the slack channel that I have been working with but I wanted to make sure to share this out with folks who may be having the same issue. Basically I was having problems with a bunch of my entities, especially AWS EC2 instances. After digging through the code, I found an issue with a few of the searches where we were missing wrapped quotes in some of the key value pairs. This was causing a few issues with some tag values that had spaces in them.
To Use
Replace:
{SPLUNK_HOME}/etc/apps/splunk_app_infrastructure/bin/em_search_manager.py
With the one included in the attached zip file.
I've already opened a case with Support and spoken to the folks on Slack, and i believe they are working on the fix but I wanted to make sure that anyone else who is experiencing this issue has a gap fill until a new release 🙂
em_search_manager.py update
For those interested in where the changes were:
under 'get_all_dims_from_dims_name'
for d in dims_name:
if d not in id_dims_name:
values_part += 'values("%s") as "%s" ' % (d, d)
spl = '| mcatalog %s WHERE metric_name=%s AND (`sai_metrics_indexes`) BY %s' % (
values_part, predicate, id_predicate)
and 'get_dimension_names_by_id_dims'
for iden in iden_fields:
fields_part += 'values("%s") ' % iden
fields_list = ', '.join(iden_fields)
spl = '| mcatalog %s, values("_dims") as "dims" WHERE metric_name=%s AND (`sai_metrics_indexes`) BY %s \
| table dims' % (fields_part, predicate, fields_list)
