Docs » Monitor services and hosts in Splunk Infrastructure Monitoring » Monitor Amazon Web Services » AWS CloudWatch metadata

AWS CloudWatch metadata ๐Ÿ”—

Infrastructure Monitoring automatically imports AWS metadata for imported AWS CloudWatch metrics. Keep in mind metadata might take up to 15 minutes to arrive.

Note

As a naming convention, the aws_ prefix is added to the original AWS property name converted to snake_case.

For example, DBClusterIdentifier becomes aws_db_cluster_identifier.

Common properties ๐Ÿ”—

For all services, the following common properties are imported:

AWS Name

Custom Property

Description

AccountId

aws_account_id

The id of your AWS account

AccountAlias

aws_account_alias

The alias of your AWS account

Region

aws_region

The region youโ€™re importing metadata from

Metadata available per service ๐Ÿ”—

Infrastructure Monitoring imports all metadata available for supported AWS, with a few exceptions and caveats. Select a specific service to see more information:

Amazon API Gateway metadata ๐Ÿ”—

For API Gateway, Infrastructure Monitoring imports the names and tags of every REST API and stage.

For more information, see the AWS documentation for API Gateway.

API Gateway Name

Custom Property

Description

ApiName

aws_rest_api_name

The APIโ€™s name

Stage

aws_stage_name

The first path segment in the Uniform Resource Identifier (URI) of a call to API Gateway

AWS Elastic Load Balancing (Classic, Application, and Network) metadata ๐Ÿ”—

For ELB, Infrastructure Monitoring scans every load balancer name for your AWS account and imports properties of the load balancer and any tags set on the load balancer.

For more information on these properties, including acceptable values and constraints, see the AWS Documentation for ELB.

ELB Name

Custom Property

Description

CreatedTime

aws_create_time

The time stamp when the load balancer was created

Note that the custom property name drops the d in aws_create_time.

AWS Auto Scaling metadata ๐Ÿ”—

For Auto Scaling, Infrastructure Monitoring imports properties of every group as well as all the tags set on the group.

For more information, see the AWS documentation for Auto Scaling.

Auto Scaling Name

Custom Property

Description

CreatedTime

aws_creation_time

Time the resource was created at. For example, Thu Apr 13 15:59:25 UTC 2017

DefaultCoolDown

aws_default_cool_down

Amount of time, in seconds, after a scaling activity completes before another scaling activity can start

HealthCheckGracePeriod

aws_health_check_grace_period

Amount of time, in seconds, that Auto Scaling waits before checking the health status of an EC2 instance that has come into service

HealthCheckType

aws_health_check_type

Service to use for the health checks

LaunchConfigurationName

aws_launch_configuration_name

Name of the associated launch configuration

NewInstancesProtectedFromScaleIn

aws_new_instances_protected_from_scale_in

Indicates whether newly launched instances are protected from termination by Auto Scaling when scaling in

PlacementGroup

aws_placement_group

The name of the placement group into which youโ€™ll launch your instances, if any

ServiceLinkedRoleARN

aws_service_linked_role_arn

ARN of the service-linked role that the Auto Scaling group uses to call other Amazon services on your behalf

Stats

aws_status

Current state of the group when DeleteAuto ScalingGroup is in progress

VPCZoneIdentifier

aws_vpc_zone_identifier

One or more subnet IDs, if applicable, separated by commas

Region

aws_region

AWS Region to which the Auto Scaling group belongs

Note that the custom property name becomes aws_creation_time instead of aws_created_time.

AWS CloudFront metadata ๐Ÿ”—

For CloudFront, Infrastructure Monitoring scans every distribution for your AWS account and imports the properties of each distribution and all the tags set on the distribution.

For more information on these properties, including acceptable values and constraints, see the AWS documentation for AWS CloudFront.

CloudFront Name

Custom Property

Description

Id

aws_distribution_id

The identifier for the distribution, for example EDFDVBD632BHDS5.

DomainName

aws_domain_name

The domain name corresponding to the distribution, for example d111111abcdef8.cloudfront.net.

Amazon DocumentDB metadata ๐Ÿ”—

For DocumentDB, Infrastructure Monitoring scans every AWS/DocDB cluster and AWS/DocDB cluster instance for your AWS account, and imports properties and tags on each instance. Since the amount of AWS/DocDB properties exceeds the amount of properties that can be kept, DBSubnetGroup has been excluded from the properties list.

For more information on these properties, including acceptable values and constraints, see the AWS documentation for Amazon DocumentDB.

AWS Direct Connect metadata ๐Ÿ”—

For Direct Connect (DX), Infrastructure Monitoring scans every Direct Connect instance for your AWS account and imports properties of each instance and any tags set on each instance.

For more information, including acceptable values and constraints, see the AWS documentation for the Direct Connect API.

Amazon DynamoDB metadata ๐Ÿ”—

For DynamoDB, Infrastructure Monitoring scans every table in your AWS account and imports properties of the table and any tags set for the table.

For more information on these properties, including acceptable values and constraints, see the AWS documentation for DynamoDB.

DynamoDB Name

Custom Property

Description

ProvisionedThroughputDescription.ReadCapacityUnits

aws_read_capacity_units

Maximum number of strongly consistent reads consumed per second before DynamoDB returns a ThrottlingException

ProvisionedThroughputDescription.WriteCapacityUnits

aws_write_capacity_units

Maximum number of writes consumed per second before DynamoDB returns a ThrottlingException

TableName

aws_table_name

Name of the DynamoDB table

TableStatus

aws_table_status

Current state of the table

Amazon Elastic Block Store (EBS) metadata ๐Ÿ”—

For EBS, Infrastructure Monitoring scans every volume ID from your AWS account and imports properties of the volume and any tags set on the volume.

For more information on these properties, including acceptable values and constraints, see the AWS documentation for EBS.

EBS Name

Custom Property

Description

attachment_state

aws_attachment_state

The attachment state of the volume

availability-zone

aws_availability_zone

The Availability Zone in which the volume was created

create-time

aws_create_time

The time stamp when the volume was created

delete_on_termination

aws_delete_on_termination

Whether or not a volume will be deleted if the instance it is attached to is terminated

encrypted

aws_encrypted

The encryption status of the volume

instance_id

aws_instance_id

ID of the instance to which the volume is attached. This property is propagated only if the volume is attached to an instance

iops

aws_iops

The number of I/O operations per second (IOPS) that the volume supports

kms_key_id

aws_kms_key_id

The full ARN of the AWS customer master key used to protect the volume encryption key for the volume

size

aws_size

The size of the volume, in GiB

snapshot_id

aws_snapshot_id

The snapshot from which the volume was created

state

aws_state

The status of the volume

volume_id

aws_volume_id

The volume ID

volume_type

aws_volume_type

The Amazon EBS volume type

Amazon Elastic Compute Cloud (EC2) metadata ๐Ÿ”—

For EC2, Infrastructure Monitoring scans every instance ID in your AWS account and imports properties of the instance and any tags set on the instance. Any property named Host or InstanceId in Infrastructure Monitoring that has the value of the instance ID, private DNS name, or private IP address gets the same tags and properties of the instance ID. Each instance property is prefixed with aws\_.

For more information on these properties, including acceptable values and constraints, see the Amazon documentation for EC2 metadata.

EC2 Name

Custom Property

Description

architecture

aws_architecture

Instance architecture (i386 or x86_64)

availability-zone

aws_availability_zone

The availability zone of the instance

dns-name

aws_public_dns_name

Public DNS name of the instance

hypervisor

aws_hypervisor

Hypervisor type of the instance (ovm or xen)

image-id

aws_image_id

ID of the image used to launch the instance

instance-id

aws_instance_id

ID of the instance

instance-state-name

aws_state

An object defining the state code and name of the instance

instance-type

aws_instance_type

Type of the instance

ip-address

aws_public_ip_address

The address of the Elastic IP address bound to the network interface

kernel-id

aws_kernel_id

Kernel ID

launch-time

aws_launch_time

The time when the instance was launched

private-dns-name

aws_private_dns_name

Private DNS name of the instance

reason

aws_state_reason

The state reason for the instance (if provided)

region

aws_region

The region in which the instance is running

reservation-id

aws_reservation_id

ID of the instanceโ€™s reservation

root-device-type

aws_root_device_type

Type of root device that the instance uses

Amazon EC2 metadata for AWS Optimizer ๐Ÿ”—

Infrastructure Monitoring AWS Optimizer helps you find cost-saving opportunities and underutilized investments in EC2. AWS Optimizer shows you usage patterns and cost attribution by InstanceType, AWS Region, and AWS Availability Zone. AWS Optimizer also shows you categories specific to your setup, such as Service, Team, and all other dimensions that come from EC2 instance tags.

AWS Optimizer generates metrics from usage and cost data imported by calls to the AWS API. These generated metrics let you visualize and analyze EC2 usage and costs, as shown in built-in dashboards. You can also create detectors based on AWS Optimizer metrics. These detectors send real-time alerts for unexpected changes in cost or usage patterns.

To import the usage and cost data to be imported, make sure the following lines are in your AWS Policy Document. To learn how to view and modify your AWS Policy Document, see Connect to AWS and send data to Splunk Observability Cloud:

"ec2:DescribeInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeTags",
"ec2:DescribeReservedInstances",
"ec2:DescribeReservedInstancesModifications",
"organizations:DescribeOrganization",

Notes on using AWS Optimizer:

  • AWS Optimizer is only available in the Splunk Observability Cloud Enterprise Edition.

  • The imported data does not include AWS billing data.

  • Infrastructure Monitoring doesnโ€™t import data or generate metrics for EC2 Spot Instances.

  • If you have multiple AWS accounts, you need to add a Infrastructure Monitoring AWS integration for each account, and each integration must have Import data for AWS Optimizer selected. If you donโ€™t set this option, your generated metrics might contain inaccurate values.

Amazon EC2 Container Service (ECS) metadata ๐Ÿ”—

For ECS, Infrastructure Monitoring scans every cluster and service for your AWS account and imports their properties as well as any tags set on the cluster or service.

For more information, see the AWS documentation for ECS.

ECS Name

Custom Property

Description

ClusterName

aws_cluster_name

A user-generated string that you use to identify your cluster.

ServiceName

aws_service_name

The name of your service.

Amazon Elastic File System metadata ๐Ÿ”—

For EFS, Infrastructure Monitoring scans every volume ID from your AWS account and imports all tags set on the volume. Observability Cloud doesnโ€™t import any properties.

For more information, including acceptable values and constraints, see the AWS documentation for EFS.

Amazon Elastic Kubernetes System (EKS) metadata ๐Ÿ”—

For EKS, Infrastructure Monitoring imports properties and tags on each instance, except for clustersโ€™ CertificateAuthorityData.

For more information, including acceptable values and constraints, see the AWS documentation for EKS.

Amazon ElastiCache metadata ๐Ÿ”—

For ElastiCache, Infrastructure Monitoring scans every cluster and node for your AWS account and imports their properties as well as any tags set on the cluster or node.

For more information about these properties, including acceptable values and constraints, see the AWS CacheCluster and AWS CacheNode documentation.

ElastiCache Name

Custom Property

Description

Applies to

ReplicationGroupId

aws_replication_group_id

The replication group to which this cluster belongs. If this field is empty, the cluster is not associated with any replication group.

Cluster metrics that are part of a replication group

CacheClusterCreateTime

aws_cache_cluster_create_time

The date and time when the cluster was created

Cluster and node

Engine

aws_engine

The name of the cache engine used by this cluster

Cluster and node

EngineVersion

aws_engine_version

The version of the cache engine by this cluster

Cluster and node

CustomerAvailabilityZone

aws_availability_zone

The AWS Availability Zone where this node was created and now resides

Node only

CacheNodeCreateTime

aws_cache_node_create_time

The date and time when the cache node was created

Node only

n/a

aws_cache_cluster_name

Either the value of aws_replication_group_id (if applicable) or the value of the dimension CacheClusterId

Cluster and node

CacheClusterId is a dimension that is already in ElastiCache MTS that Infrastructure Monitoring imports from AWS Cloudwatch.

Amazon Elastic Beanstalk metadata ๐Ÿ”—

For Elastic Beanstalk, Infrastructure Monitoring imports properties and tags.

For more information, including acceptable values and constraints, see the AWS documentation for Elastic Beanstalk.

Elastic Beanstalk Name

Custom Property

Description

ApplicationName

aws_application_name

The name of the application associated with this environment

SolutionStackName

aws_solution_stack_name

The name of the SolutionStack deployed with this environment

TemplateName

aws_template_name

The name of the configuration template used to originally launch this environment

Status

aws_status

The current operational status of the environment.

Possible values are:

  • Aborting: The environment is aborting a deployment

  • Launching: The environment is in the process of initial deployment

  • LinkingFrom: The environment is being linked to by another environment. See Environment links for details

  • LinkingTo: The environment is in the process of linking to another environment. See Environment links for details

  • Updating: The environment is updating its configuration settings or application version

  • Ready: The environment is available to have an action performed on it, such as update or terminate

  • Terminating: The environment is shutting down

  • Terminated: The environment is not running

VersionLabel

aws_version_label

The application version deployed in this environment

Amazon Elastic MapReduce (EMR) metadata ๐Ÿ”—

For EMR, Infrastructure Monitoring scans the properties of every cluster as well as any tags set on each cluster.

For more information on these properties, including acceptable values and constraints, see the AWS documentation for the DescribeCluster API.

EMR Name

Custom Property

Description

Id

aws_cluster_id

AWS identifier of the cluster

Name

aws_cluster_name

The name you gave the cluster

AutoScalingRole

aws_auto_scaling_role

An IAM role for automatic scaling policies

CustomAmiId

aws_custom_ami_id

The ID of a custom Amazon EBS-backed Linux AMI if the cluster uses a custom AMI

InstanceCollectionType

aws_instance_collection_type

The instance group configuration of the cluster

LogUri

aws_log_uri

The path to the Amazon S3 location where logs for this cluster are stored

MasterPublicDnsName

aws_master_public_dns_name

The DNS name of the master node

ReleaseLabel

aws_release_label

The Amazon EMR release label, which determines the version of open-source application packages installed on the cluster

RepoUpgradeOnBoot

aws_repo_upgrade_on_boot

Applies only when CustomAmiID is used

RequestedAmiVersion

aws_requested_ami_version

The AMI version requested for this cluster

RunningAmiVersion

aws_running_ami_version

The AMI version running on this cluster

ScaleDownBehavior

aws_scale_down_behavior

The way that individual Amazon EC2 instances terminate when an automatic scale-in activity occurs or an instance group is resized

SecurityConfiguration

aws_security_configuration

The name of the security configuration applied to the cluster

ServiceRole

aws_service_role

The IAM role that the Amazon EMR service uses to access AWS resources on your behalf

Status

aws_status

The current status details about the cluster

AutoTerminate

aws_auto_terminate

Specifies whether the cluster terminates after completing all steps

TerminationProtected

aws_termination_protected

Indicates whether Amazon EMR locks the cluster to prevent the EC2 instances from being terminated by an API call or user intervention, or in the event of a cluster error

VisibleToAllUsers

aws_visible_to_all_users

Indicates whether the cluster is visible to all IAM users of the AWS account associated with the cluster

NormalizedInstanceHours

aws_normalized_instance_hours

An approximation of the cost of the cluster, represented in m1.small/hours

Amazon Elasticsearch Service metadata ๐Ÿ”—

For Elasticsearch, Infrastructure Monitoring scans every domain from your AWS account and imports the version and any tags set on the domain.

For more information, see the documentation for AWS Elasticsearch

Elasticsearch Name

Custom Property

Description

ElasticsearchVersion

aws_es_version

The Elasticsearch version, for example 7.1.

Amazon Kinesis Firehose metadata ๐Ÿ”—

Infrastructure Monitoring imports Kinesis Firehoseโ€™s tags. For more information refer to AWS documentation.

Amazon Kinesis Streams metadata ๐Ÿ”—

For Kinesis Streams, Infrastructure Monitoring scans the properties of every stream as well as any tags set on each stream. If shard-level metrics are enabled in AWS, properties and tags are also applied to Kinesis shards for their respective parent streams.

For more information, see the AWS documentation for the StreamDescription API.

Kinesis Name

Custom Property

Description

StreamName

aws_stream_name

The name of the stream

StreamStatus

aws_stream_status

The server-side encryption type used on the stream

RetentionPeriodHours

aws_retention_period_hours

The current retention period, in hours

Amazon Kinesis Analytics metadata ๐Ÿ”—

Infrastructure Monitoring imports Kinesis Analyticsโ€™ properties and tags, except for ApplicationConfiguration.

For more information refer to AWS documentation.

AWS Lambda metadata ๐Ÿ”—

For AWS Lambda, Infrastructure Monitoring scans every version of every function associated with your AWS account and imports properties of the function version and any tags set on the function. Infrastructure Monitoring also imports the lambda_arn dimension, which is the qualified ARN for an AWS Lambda function.

For more information on these properties, including acceptable values and constraints, see the AWS Lambda documentation for API function configuration.

AWS Lambda Filter Name

Custom Property

Description

CodeSha256

aws_function_code_sha256

SHA256 hash of your function deployment package

CodeSize

aws_function_code_size

The size of the .zip file you uploaded for the function, in bytes

FunctionName

aws_function_name

Function name

MemorySize

aws_function_memory_size

Memory size you configured for the function, in MB

Runtime

aws_function_runtime

Runtime environment for the function

Timeout

aws_function_timeout

The function execution time at which AWS Lambda needs to terminate the function

Version

aws_function_version

The function version

VpcConfig.vpcId

aws_function_vpc_id

The VPC ID associated with your function

Amazon VPC (NAT Gateway) metadata ๐Ÿ”—

Infrastructure Monitoring imports all Amazon VPC (NAT Gateway) properties and tags.

For more information on these properties, including acceptable values and constraints, refer to AWS documentation.

Amazon Relational Database Service (RDS) metadata ๐Ÿ”—

For RDS, Infrastructure Monitoring scans every database instance for your AWS account and imports properties of each instance and any tags set on each instance.

For more information, including acceptable values and constraints, see the AWS documentation for the DBCluster API.

RDS Name

Custom Property

Description

AvailabilityZone

aws_availability_zone

Name of the DB instance Availability Zone

DBClusterIdentifier

aws_db_cluster_identifier

If the DB instance is a member of a DB cluster, contains the name of the DB cluster

DBInstanceClass

aws_db_instance_class

Name of the compute and memory capacity class of the DB instance

DBInstanceStatus

aws_db_instance_status

Current state of the DB instance

Engine

aws_engine

Name of the database engine this DB instance uses

EngineVersion

aws_engine_version

Database engine version.

InstanceCreateTime

aws_instance_create_time

DB instance creation date and time

Iops

aws_iops

New Provisioned IOPS value for the DB instance. AWS might apply this value in the future, or might be applying it at the moment.

MultiAZ

aws_multi_az

Indicates if the DB instance is a Multi-AZ deployment

PubliclyAccessible

aws_publicly_accessible

Accessibility options for the DB instance. "true" indicates an Internet-facing instance with a publicly resolvable DNS name that resolves to a public IP address. "false" indicates an internal instance with a DNS name that resolves to a private IP address.

ReadReplicaSourceDBInstanceIdentifier

aws_read_replica_source_db_instance_identifier

If the DB instance is a Read Replica, this value is the identifier of the source DB instance.

SecondaryAvailabilityZone

aws_second_availability_zone

If this property is present, and the DB instance has multi-AZ support, this value specifies the name of the secondary Availability Zone.

StorageType

aws_storage_type

Storage type associated with the DB instance

Amazon Redshift metadata ๐Ÿ”—

For RedShift, Infrastructure Monitoring scans every cluster for your AWS account and imports properties of the cluster and any tags set on the cluster.

For more information, including acceptable values and constraints, see the AWS documentation for the RedShift Cluster API.

Redshift Name

Custom Property

Description

ClusterIdentifier

aws_cluster_identifier

The unique identifier of the cluster

AvailabilityZone

aws_availability_zone

Name of the Availability Zone in which the cluster is located

ClusterCreateTime

aws_cluster_create_time

Creation date and time for the cluster

ClusterStatus

aws_cluster_status

The current state of the cluster

ClusterRevisionNumber

aws_cluster_revision_number

Revision number of the database in the cluster.

ClusterVersion

aws_cluster_version

Version ID of the Amazon Redshift engine that is running in the cluster

NodeType

aws_cluster_node_type

The node type for the nodes in the cluster

DBName

aws_cluster_db_name

Name of the initial database created when the cluster was created

Encrypted

aws_cluster_encrypted

Boolean. If true, indicates that data in the cluster is encrypted at rest.

MasterUsername

aws_cluster_master_username

Master user name for the cluster. This is the name used to connect to the database specified in the DBName parameter.

PubliclyAccessible

aws_cluster_publicly_accessible

Boolean. If true, indicates that the cluster can be accessed from a public network.

Amazon Route 53 metadata ๐Ÿ”—

Infrastructure Monitoring imports Route 53โ€™s common properties and tags.

For more information refer to AWS documentation.

Amazon Simple Storage Service (S3) metadata ๐Ÿ”—

For S3, Infrastructure Monitoring imports the region in which the bucket resides, as well as any tags set on buckets. Infrastructure Monitoring only imports metadata for non-empty buckets.

For more information on S3 bucket tags, see the documentation for AWS S3 Cost Allocation tagging.

S3 Name

Custom Property

Description

Region

aws_region

The region in which the S3 bucket resides

Amazon Simple Notification Service (SNS) metadata ๐Ÿ”—

Infrastructure Monitoring imports SNSโ€™ tags only. For more information refer to AWS documentation.

SQS metadata ๐Ÿ”—

For SQS, Infrastructure Monitoring imports properties of every queue as well as any tags set on the queue.

For more information on these properties, including acceptable values and constraints, see the AWS developer documentation for SQS.

SQS Name

Custom Property

Description

QueueArn

aws_queue_arn

AWS resource name of the SQS queue

QueueURL

aws_queue_url

URL for the SQS queue

MaximumMessageSize

aws_maximum_message_size

Maximum size of a message that SQS accepts, in bytes. SQS rejects a message that is larger than this value.

CreateTimestamp

aws_created_timestamp

Creation timestamp for the SQS queue

VisibilityTimeout

aws_visibility_timeout

Visibility timeout for the queue

FifoQueue

aws_fifo_queue

Indicates whether the queue is a fifo queue

Region

aws_region

The region in which the SQS resides

AWS Step Functions metadata ๐Ÿ”—

For Step Functions, Infrastructure Monitoring scans every state machine for your AWS account and imports all instancesโ€™ properties, and any tags set on each instance.

For more information, including acceptable values and constraints, see the AWS documentation for the State Machine.

Amazon VPC VPN metadata ๐Ÿ”—

Infrastructure Monitoring imports Amazon VPC VPNโ€™s common properties and tags.

For more information refer to AWS documentation.

Amazon WorkSpaces metadata ๐Ÿ”—

For WorkSpaces, Infrastructure Monitoring scans every WorkSpace instance for your AWS account and imports all instancesโ€™ properties, and any tags set on each instance.

For more information, including acceptable values and constraints, see the AWS documentation for the WorkSpaces API.