Thanks for this, I tried it but it doesn't give me what I want. I think the problem is because no events are returned because of "pending=false" ... View more

Absolutely useless. I am assuming you didn't even read the question. ... View more

Thanks, I think I get what you mean but not sure how to implement it. I will do some googling and see what I can find. ... View more

Hi, I should have said that the search is usually "server_group=*", I am just using this group because it is the offending group that is giving me problems. I don't really understand the point of creating a lookup for this, the search already returns the servers that are being monitored. ... View more

Got it in one! Showing the results exactly as I want them. Thanks for your help. ... View more

Hey thanks for looking at this for me. I ran this search and it returns zero results. I am unclear what the purpose of the subsearch is here. ... View more

Hi @isoutamo , Thanks for this, that's given me exactly what I was looking for! ... View more

Hi @Nisha18789 ,   Yup this is exactly what I was looking for. Can't thank you enough for taking the time to help me with this!   Very much appreciated. ... View more

Hi @Nisha18789 , I think this is almost it, the only problem is the percentages. It would need to be a percentage of the total amount of unpatched machines in each server group rather than the current "100-percent" calculation it is doing. I think the calculation would be: unpatched_machines/total_machines_in_group*100 Thanks again for your help! ... View more

@Nisha18789  So I tried the search but unfortunately it doesn't show me what I was looking for. I am trying to use the first search you provided, but show those results for all of the server groups. If I just use pending=true, that should only show me devices that have pending patches. And from there I would like to know the percentage of that number in relation to all the machines in the same server group. Appreciate your help with this. ... View more

@Nisha18789  Apologies I should have explained, the pending field is either "true" or "false", if true it means there are still patches to apply. Thanks for the search query I will try it just now. ... View more

@Nisha18789  This has done exactly what I want, thank you! I wonder if you could help me with one other query? It is in the same index and sourcetype, I've now been asked if I can show the same information for each server group. The search I have is: index="automox" sourcetype="automox:devices" server_group="*" | dedup name | stats count by pending, server_group | eventstats sum(count) as perc | eval perc=round(count*100/perc,2) | search pending=false | table pending, count, perc, server_group However this just gives a percentage based on the amount of machines within each server group, which is not what I was looking for. What I want is like below: pending count perc server_group FALSE 9 8.11 Linux Servers FALSE 1 0.9 Linux Workstations FALSE 4 3.6 MacOS Workstations FALSE 30 27.03 Windows Server Full FALSE 4 3.6 Windows Workstations   But the percentage is based on the total amount of machines, rather than how many exist within the server group. As an example, if I run your search you provided with the extra bit, server_group="Windows Workstations", then the percentages it gives me are: column row 1 %patch_pend 90.48 %patched 9.52 And this is what I would expect. The reason I am trying to do this, is so that on a dashboard I can show a trellis view of each server group and the percentage of unpatched(or patched) machines. I hope that makes sense and sorry for the wall of text! ... View more

The data models are accelerated and they do return events. ... View more

I'm going to answer this for anyone in the future that has this issue, below is the recommendation from Splunk support on how to fix this issue. I first disabled the aws_inspector input then made the changes and re-enabled it. This sorted my issue and I was able to get inspector data in to Splunk. The recommendation is to backup and delete the file labeled internals inside the checkpoint directory at: /$SPLUNK_HOME/var/lib/splunk/modinputs/aws_inspector The issue is a checkpoint file has been created which contains nothing which is trying to be read. Restart splunkd after performing this task. ... View more

Okay I was thinking we can just use a UF instead. I agree about the bottleneck and single point of failure but we were told it is best practice to point towards an HF before sending to the cloud. It is also where all our SaaS add-ons are configured so we do need it in some capacity. ... View more

Hey thanks for the reply, I should have said in my original comment that I had tried this already but for the majority of the dashboards I don't get any data at all. It seems there is some historical detailed billing info coming through but for all other searches nothing is returned. For example, it cannot even find any account id's when running this search: aws-billing-monthly-accounts | aws-accountid-to-name The outcome is the same if I preface it with index=aws_billing I'm not really sure where to go with it because the account I am using has full read access to the billing s3 bucket and has no issues pulling the data in and the data is definitely there. And the documentation (https://docs.splunk.com/Documentation/AddOns/released/AWS/Billing) is not up to date with the "recommended" way to do this (With cost & usage reports). Have you yourself got this information working? How is the add on configured? Is it legacy or with the cost & usage reports? ... View more