We have the Splunk Add-on for Amazon Web Services running on a cluster of heavy forwarders pulling most data in from S3 inputs. The only exception is the description/metadata input which is configured through the bin/tools/configure/aws_config_cli.py command. Due to this separation it looks like the all_account_ids.csv lookup doesn't get generated to be used in the AWS App. How can I generate this separately?
Use following in search for Splunk App for AWS
index=your_aws_index sourcetype="aws:addon:account" | dedup host, account_id, name | fields - _time |dedup account_id| table name, account_id | outputlookup all_account_ids
This should help.