Data Manager

Troubleshooting Manual

This documentation does not apply to the most recent version of Data Manager. For documentation on the most recent version, go to the latest release.

Troubleshoot AWS Lambda Functions data ingestion

Troubleshoot AWS Lambda Functions data ingestion process.

AWS Lambda Functions data cannot be found

AWS Lambda Functions data cannot be found.

Cause

AWS Lambda Functions are not configured correctly and data is not being ingested from AWS Lambda Functions.

Solution

  1. In the AWS console navigate to Lambda function in the AWS account and region where data is not flowing. The following table shows the sata source and its associated Lambda function.
    Data Source Lambda Function Name
    EC2 Instance SplunkDMMetadataEC2Inst
    EC2 Security Group SplunkDMMetadataEC2SG
    EC2 Network ACLs SplunkDMMetadataEC2NetworkAcl
    IAM Users SplunkDMMetadataIAMUsers
    CloudTrail SplunkDMCloudWatchLogProcessor
    CloudWatchLogs SplunkDMCloudWatchLogsEventProcessor
  2. Select the appropriate Lambda function.
    1. Select Monitor and verify that the Lambda function was invoked by looking at Invocations metrics. Make sure to select the appropriate time range.
    2. If the Lambda function was invoked in that time interval, then check the Throttles and Error count metrics.If any of the Throttles and Error count metrics is non-zero, check the logs of the Lambda function by clicking on View logs in CloudWatch.
  3. If the configuration is correct and your data still cannot be found, Contact Splunk Support.
Last modified on 07 February, 2022
Troubleshoot AWS Kinesis Firehose data ingestion  

This documentation applies to the following versions of Data Manager: 1.3.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters