All Apps and Add-ons

Splunk App and Add-on for AWS: How to resolve CloudWatch Logs input that are not being ingested?

pierreyanni
Engager

Using Splunk App for AWS (v5.0.0) and Splunk Add-On for Amazon Web Services (v4.1.2), we have configured a "CloudWatch Logs" input against a specific log group in our AWS account. The log group is a sort of catch-all, being populated with various log entries coming from an application. The input was configured with a sourcetype of "aws:cloudwatchlogs", but we are seeing no data for that sourcetype.

We also found that by default, the stream matching regex was set to "eni.*", which would be correct for VPC Flow Logs -- so we changed this to be simply ".*" using the Splunk Add-On for Amazon Web Services (the stream matching regex is not a configuration option in the Splunk App for AWS itself) -- to no avail. We still are not getting any entries with the sourcetype of "aws:cloudwatchlogs".

Which log file or files can we check in to further diagnose the issue here? Any other advice to try to determine why these entries are seemingly not being indexed?

Thanks.

1 Solution

pierreyanni
Engager

Seems that upgrading to the latest versions of both the Splunk App and the AWS Add-on has resolved this issue.

View solution in original post

pierreyanni
Engager

Seems that upgrading to the latest versions of both the Splunk App and the AWS Add-on has resolved this issue.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...