If your data in CloudWatch Log won't be too big, then it's fine to use the AWS Add-on CloudWatchLog mod input to collect it. Otherwise, we recommend you use Kinesis stream and the Kinesis mod input: http://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatchLogs You can use the AWS TA web UI to configure the CloudWatchLog input http://.../en-US/app/Splunk_TA_aws/inputs, the logGroup fields can be a list of log groups, such as /aws/lambda/s3table-chalice,/aws/lambda/ListBucketInfo,/aws/lambda/NoOp,/aws/lambda/GetBucketInfo,/aws/lambda/UpdateBucketInfo If you are using the distributed environment of Splunk Cloud with heavyweight forwarder to collect AWS data, then yes, pls raise a ticket. Otherwise, for single instance Splunk Cloud instance, you can use the web UI to configure the CloudWatchLog input by yourself. Hope it helps. ... View more

What's the namespace for your custom metrics? By default the AWS App collections all metrics names under AWS/EC2. If you check the input in the AWS TA, the metrics names are wildcard .* If you define own metrics namespace, you can use the AWS Add-on configuration to type the namespace and custom metrics name/dimensions. The URL are en-US/app/Splunk_TA_aws/inputs and docs are http://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatch ... View more

Hi Reosoul, the Splunk App for AWS uses the AWS TA to collect the data. For such advanced settings, it's not exposed on the App UI (as we try to make the app configuration as easy as possible). You can open the 'Splunk Add-on for AWS', filter by Service:S3, and edit the modular input. In the 3rd tab 'Template', yo can set the "Start Date/Time" value. Sorry it's a plain text filed. The format of the value can be found on the TA documentation: http://docs.splunk.com/Documentation/AddOns/latest/AWS/S3 initial_scan_datetime Relevant only the first time the input runs, this value indicates the oldest file time that should match a file scan, using ISO8601 formatting (for example, 2011-07-06T21:54:23.000-07:00). This value defaults to seven days ago, calculated back from the date you configure the input stanza. ... View more

you are welcome ... View more

In the AWS App configuration UI, when you add Config data source, the app will automatically trigger a Config snapshot for you. You can see the timestamp of last snapshot. You can manually trigger config snapshot via CLI: aws configservice deliver-config-snapshot deliver-config-snapshot There is no easy way to check whether a queue is used by others. I sometimes just create a new queue, subscribe to the SNS topic and use that new queue in my app ... View more

There might be couple reasons: Do you have instances in other regions? aws:description will capture all instances in all regions, but aws:config is only for those regions that you've enabled config service with proper SNS/SQS Make sure you've taken Config snapshot. It should be automatically done when you add AWS account in the splunk app. Config history is incremental change, taking a snapshot will capture all existing resources, even they are created before you enable Config service Make sure the SQS queue for the Config topic is not used by the other program/user. With the latest AWS App(v4.1.1) and TA(v3.0.0), we increase the use of description API, and only use config data in the topology view. If you have instances across regions, it's quite a lot configuration work to setup all config services with S3/SNS/SQS. So you can trust the data from aws:description. Hope it helps. ... View more

Hi Rainer, are you talking about the EC2 instance tags you assigned via AWS Management console? They are available in the Config data. The AWS Description or Metadata(on AWS App) are mainly to collect the runtime information of the instances/vpc/securityGroup. You can try enabling the Config data for that region, then all tags will be available in Config JSON files. You can then search by tags. ... View more

Glad to hear such feedback. Happy new year, and you will enjoy the next release of this great app. ... View more

Hi Jason, The initial inventory get populated by triggering a AWS Config Snapshot. When you add a Config input, the snapshot will be triggered automatically, unless your IAM user don't have such permission. Setting up config service for all regions and all 9 accounts really is a lot of work. So, let me share some good news (I am the dev manager of this app at Splunk, BTW): 1) in the upcoming 4.1 AWS app which will be available in 1 or 2 months, we will be using AWS REST API to list all resources, so you don't have to configure the Config, unless you want to use the topology tool. 2)AWS itself is enhancing the AWS config service so that you can use 1 region to capture all inventory in all regions. 3) recently AWS config has published a feature to let you capture the IAM user/group/role/permission. We are in the process of enhancing topology tool to visualize those IAM resources. For the time being, you may have to create 9*9 SNS topics, 9*9 SQS queues. You may use CloudFormation or similar tool to automate it. Or you can wait for 1 or 2 months for the next release of AWS app, but with 4.0 app you can still monitor other data sources, such as CloudWatch, billing, VPC flow log. Hope it helps ... View more

Hello, I am the dev manager of the Splunk App for AWS. We currently don't have a built-in dashboard for Route53. Would you like to share your use cases and sample dashboards, we may add such analysis in future versions. ... View more

Hi David, I saw your email in the system. I will let PM to contact you. ... View more

Hi David, is the RDS log available via S3 bucket? If so, you can use the S3 modular input to index them. Otherwise, we need check with other customers and product management team to prioritize it. -- Jove Z (development manager of the Splunk App for AWS) ... View more

Hi Björn, You said the the second panel uses custom javascript. Is that a customized visualization or some HTML text or image? Do you use to load single JavaScript or the my.js will load extra JavaScript. Unlike the splunk web, the dashboard on mobile app is parsed and rendered locally. So if your JavaScript uses any splunkweb-specific URL, such as /static/app/myapp/mycomponent.js or ../app/myapp/mycomponent.js, it won't work on mobile. Instead you can try to get the current entry JavaScript file and load a JS file in the same folder. Sample code: var staticFolder=getParentURL() function getParentURL(){ var scripts = document.getElementsByTagName('script'); var thisScript = scripts[scripts.length-1]; var path = thisScript.src var last = path.lastIndexOf('/') var parent = path.substr(0,last) return parent } require.config({ paths:{ 'mychart':staticFolder+'/mychart' } }); ... View more

You can index the csv in Splunk Enterprise, then have your iOS app to call the splunkd REST API. Check the REST API Ref: http://docs.splunk.com/Documentation/Splunk/6.2.0/RESTREF/RESTsearchExamples ... View more

yes. But once the trail license expires, the mobile solution won't work because it requires the ACL feature in Enterprise Edition. ... View more

I think you can just follow the documentations of your proxy server. For example, if you use nginx, you can add this to the nginx.conf location / { proxy_pass https://yourhost; } Because the mobile app expects to talk to mobile server via HTTPS (HTTP will be denied). So if you are going to use a proxy in front of the mobile access server, please make sure you enable the proxy with HTTPS. You can choose to start the mobile access server in HTTP mode, for example: http://my_host:8080 Then use the proxy to expose it as https://prox_host ... View more

The Splunk Mobile App & Server is all about showing splunk dashboards, reports, and alerts on mobile device. There are another 2 mobile related offering from splunk: the Splunk SDK for Java, C# and other programming languages allow you to send data to splunk or search from splunk in your mobile app. Bugsense, which was acquired by Splunk in 2013, provides iOS/Android/WP SDK for you to track app crash, usage, and custom events. Those data are sent to BugSense cloud service and visualize on the web portal. In next few months, there will be a new offering from the BugSense team, to better integrate such mobile data collection with Splunk Enterprise. Putting in short Splunk Mobile App is about visualize Splunk dashboards and real-time alert Splunk SDK is about sending data to splunk or creating new search job Splunk Bugsense and the upcoming new product is about to gather data from mobile devices and custom app, and send it to Splunk ... View more

Hi there, Glad to know you're going to build mobile-friendly mobile app. Maybe I can post a blog later, but putting in short, you are recommended to build the dashboards with SimpleXML. Then you can enable the app and dashboards on Splunk Mobile Access Server web console. It'll be okay if you use JavaScript Extension in the SimpleXML dashboards, but some splunkweb JavaScript classes are not available in the mobile app. Plus if you define CSS or refer to images or other files, make sure don't use the absolute URL for splunkweb, such as /static/app/appmgmt/arch.png Let me know if you encounter any issue. -- Jove Z. Dev Manager of Splunk Mobile App & Server ... View more

+1, I encountered the same issue for REST API call. ... View more

Recently Splunk Mobile App for iOS is released, together with the Splunk Mobile Access Server. It's a native iOS app for iPhone and iPad, with the same dashboard/chart rendering toolkits in splunk web. Please have a try and share your thoughts. Thanks. ... View more

You may try the Splunk Mobile App and Mobile Access Server, which are released in July 2014. It leverages the same web framework, but improved the UX on mobile devices. Have a try, and share your thoughts. Thanks. ... View more