Splunk for AWS get_instances.py not running?

[jdunlea_splunk]

Using the Splunk app for AWS we cannot get the get_instances.py script to run without throwing an error.

We keep getting the error saying "running_all is not defined"... How do we get this script to run successfully?

[jdunlea_splunk · Accepted solution]

There are many things depending on this app working correctly, mainly the aws.conf file.

However if everything looks right, but you are still getting this error, then perform the following:

1 - There may be a typo in the script - search the script for "spleep" and change to read "sleep"

2 - Update the "boto" python libraries in the SplunkAppforAWS using the following commands (linux):

sudo yum install python-pip
sudo python-pip install boto --upgrade

3 - Search the get_instances.py script for the line that reads "running_all = ec2_conn.get_all_instances()"

4 - Right above this line, enter the following. "running_all = []"

Now your script should read as follows:

running_all = []
running_all = ec2_conn.get_all_instances

After all of this, restart splunk and you should be good.