All Apps and Add-ons

Splunk Add-On for AWS: should I use 1 or many SQS for the various inputs?

lhanich1
Path Finder

I am currently utilizing SQS ingestion for all the inputs within the app. I am noticing some duplicity with the sources indexing across 2 different indexes. Should I be using a different SQS for each input? As of now, we are using 1 SQS stream across all the inputs within the Splunk Add On for AWS.

Thanks

0 Karma

amiracle
Splunk Employee
Splunk Employee

What are the two indexes you are seeing the data flow into? By default the add-on will write the data to the main or default index. Then the saved searches will summarize some of the data and put them into summary indexes. That is normal behavior, so before you stop ingesting data, let's make sure you're not looking at both the summary and default indexes.

0 Karma

lhanich1
Path Finder

Every Input is designated to its rightful index so it is not all dumping into 1 index.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...