Use the Content Pack for Amazon Web Services Dashboards and Reports

Once you install the Content Pack for Amazon Web Services Dashboards and Reports in your environment and configure the Splunk Add-on for AWS to collect data, use the content pack to proactively monitor and troubleshoot your environment.

Prerequisites

• You must set up the Splunk Add-on for AWS to collect data. See, Installation overview for the Splunk Add-on for AWS.
• You must install and configure the content pack. See, Install and configure the Content Pack for Amazon Web Services Dashboards and Reports.

Monitor your AWS Cloud entities

The content pack includes the four entity types that group entities originating from AWS Cloud.

• EC2 Instance
• EBS Volume
• Lambda Function
• ELB Instance

The entity types contain a set of vital metrics, which are statistical calculations based on SPL searches that represent the overall health of entities of that type. To view the Entity Health page for the entity types, follow these steps:

• From the ITSI menu or IT Essentials Work menu, select Infrastructure Overview.
• In the Group by dropdown, select Entity Type.
• Select the entity type to drill down into its vital metrics.

For more information about entity types and vital metrics, see Overview of entity types in ITSI in the Entity Integrations manual.

You can select an individual entity on the Entity Health page to drill down further into overview dashboard to view the entity type's performance metrics and log events. The Event Data Search dashboard displays the most recent log events associated with an entity over the last hour. The Analytics dashboard lets you view the trend of data coming in from each host by source type in a single snapshot.

Dashboards overview

The Content Pack for Amazon Web Services Dashboards and Reports includes several dashboards to give you insight into your AWS data. For detailed descriptions of each of the available dashboards, see Dashboard reference for the Content Pack for Amazon Web Services Dashboards and Reports.

Access the content pack dashboards

To access the content pack dashboards, perform the following steps:

1. Log into Splunk Web.
2. Select App > IT Service Intelligence or IT Essentials Work.
3. Select Dashboards > Dashboards to see the list of the dashboards. All AWS dashboards have a suffix of AWS.

Filter dashboards by tags

You can filter the dashboards included in the Content Pack for Amazon Web Services Dashboards and Reports by tags you define in Amazon Web Services. Tags are custom metadata that you can use to identify and organize your AWS resources. Each of your resources can have up to 10 tags, each of which has a key and an optional value.

Use the tags filter on a dashboard

To use the tags filter, navigate to any dashboard that supports the filter, such as the Overview dashboard.

In the Tags field, enter your search criteria for filtering AWS resources data based on tag values. The filter supports the following operators:

• key=value
• key!=value
• key1=value1 AND key2=value2
• key1=value1 OR key2!=value2

Some dashboards do not include a tags filter because the data in the dashboard is not relevant to the tags.

Select tags for your Historical Detailed Billing and Capacity Planner dashboards

All custom tags are disabled by default to prevent large reports from slowing down performance. Both the Historical Detailed Billing and Capacity Planner dashboards rely on data from your billing reports with resources and tags.

Perform the following steps to select tags for your Historical Detailed Billing and Capacity Planner dashboards:

1. A Splunk platform admin can select the custom tags that appear in your tag filters configured using the Configure AWS Billing Tags Dashboard.
   1. When you initially select tags and each time you change your selections, your Capacity Planner and Historical Detailed Billing dashboards are unavailable while their underlying data models are rebuilt to reflect your tag selections.
   2. The time required for the data models to rebuild depends on the volume of your billing data.
2. You can check the status of the data models by going to Settings > Data models and expanding the rows for the Detailed Billing, Detailed Billing CUR, Instance Hour, Instance Hour CUR data models.
3. The tags that you choose to use on your dashboards are available both as standard filters at the top of the dashboard and in special Group By filters.
   1. In the Cost Analysis section of the Historical Detailed Bills dashboard, you can filter your data by Service and Operation, and then further group the results by either the Product Name, Availability Zone, Operation, or any custom tags that you select.
   2. Similarly, on the Capacity Planner dashboard, you can group by Instance Type, Reservation, Availability Zone, or any custom tags you have selected.

In the Tags drop-down menu, the app replaces any special characters in your tags with underscores and truncates tag names to the first 32 characters. When searching for a tag, modify your search to match.

For more information about how to create tags in AWS, see, http://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/tag-editor.html.

For an example of tagging EC2 resources, see http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html.

Configure custom AWS Billing tags

Manually enable custom tags from the AWS Billing & Cost Management console to filter and group billing data in the Capacity Planner and Historical Detailed Billing dashboards. By default, custom AWS billing tags are disabled in the Content Pack for AWS Dashboards and Reports. For better performance, select only the tags you need.

You must have admin permissions to configure Billing tags.

To select tags to filter and group data, follow these steps:

1. In Splunk Web, open IT Service Intelligence (ITSI) or IT Essentials Work.
2. Go to Dashboards.
3. Open the Configure AWS Billing Tags - AWS dashboard from the list of dashboards.
4. Click Select Billing Tags if you want to configure tags for AWS Legacy Billing or click Select Billing Tags CUR to configure tags for AWS Cost and Usage Reports (CUR) Billing.
5. If you created custom tags in the AWS Billing & Cost Management console, they appear in the dialog box. Select each tag you want to use in the Capacity Planner and Historical Detailed Billing dashboards.
6. When you are done, click Save.

To learn more about creating custom tags, see https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html.

Use the Insights dashboards

On the Insights dashboards in the Content Pack for Amazon Web Services Dashboards and Reports, the content pack evaluates your AWS environment and provides the following insights and suggested actions to help you optimize your AWS resources.

Delete security groups

The content pack polls your security groups to check if any are not assigned to an EC2 instance. You can delete unused security groups to free up screen space to organize and manage your environment.

For more information about deleting a security group using the command line interface (CLI) or in the AWS management console, see http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html#deleting-security-group.

Upgrade or downgrade instances

The content pack evaluates your instance usage to determine if any instances are either over or under utilized. The app identifies the instances that can be resized to a larger instance type to avoid performance problems or downtime. The app also identifies instances that are underutilized so that you can resize those to smaller instance types.

For more information about modifying an instance type using the AWS Management Console, see http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-resize.html. For more information about the modify-instance-attribute CLI command, see http://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-attribute.html.

Recommended actions for load balancers

The content pack evaluates your Elastic Load Balancing (ELB) usage and their registered instances and recommends actions for load balancers identified with problems. The recommended actions include the following:

• To delete load balancers, see http://docs.aws.amazon.com/cli/latest/reference/elb/delete-load-balancer.html.
• To troubleshoot load balancers, see http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/ts-elb-healthcheck.html.

Recommended actions for Elastic Block Store

Based on your Amazon Elastic Block Store (EBS) usage, the content pack provides information and recommended actions to help you optimize your EBS resources. Refer to the following AWS documentation for information and instructions about managing EBS resources:

• To delete an Amazon EBS volume, see http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-deleting-volume.html.
• To take EBS snapshots, see http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html.
• For Amazon EBS–optimized instances, see http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSOptimized.html.
• For EBS input/ output operations per second (IOPS) detail information, see https://aws.amazon.com/ebs/details.html.