I recently started up my Splunk instance in AWS and I have all the necessary apps installed on it to monitor my AWS environment. In the Splunk Add-On for AWS I set up my Config input and for some reason Splunk is failing to ingest my config files from my S3 bucket. Does anyone have any suggestions on how to fix this?
Thanks
Hi Rich,
So I basically have one EC2 instance with the Splunk AMI installed on it. This instance is acting like the indexer and search head. For the Splunk Add-on for AWS I configured the Config input with the SQS-based S3 input. Here is a screenshot of the error I am getting from splunk. I see in the search/detail summary section that my config files appear to be ingested but I am not seeing the config data in the Splunk App for AWS and I am seeing health check errors.