https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Add-on-for-Amazon-Web-Services-Why-am-I-unable-to-get/m-p/153038#M13821 <P>that log says it's getting into the queue okay, but not finding anything there. Can you look at the queue from Amazon's management page and see if there are messages?</P> Sat, 26 Sep 2015 20:53:23 GMT jcoates_splunk 2015-09-26T20:53:23Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Add-on-for-Amazon-Web-Services-Why-am-I-unable-to-get/m-p/153037#M13820 <P>Hi</P> <P>I have tried to follow the setup guide for creating inputs and cloudtrail and was-config are working great now. However, I cannot get any data into Splunk from cloudwatch. Usual suspects such as IAM permissions etc are all verified (and working for the other services)</P> <PRE><CODE>index = _internal source=*aws_cloudwatch* </CODE></PRE> <P>Just shows repeated messages of....</P> <PRE><CODE>2015-08-03 21:42:01,743 INFO pid=20635 tid=MainThread file=aws_cloudwatch.py:stream_events:978 | query work queued = 0, deferred = 0 , scan_time = 0.000s </CODE></PRE> <P>I suspect my config around metric_dimensions isn't quite right, but the docs are a little vague on this. I wanted to capture information from any instance in my (small) account, but even setting to a specific Instance ID, I still get no data and my cloudwatch index is reported as empty. (config below)</P> <P>It's driving me mad now and although I can find a few people reporting the same problem, I can't see any posted answers.</P> <P>Any help appreciated.</P> <PRE><CODE>[aws_cloudwatch] aws_account = xxxxxxxxxxxxxxx aws_region = eu-west-1 metric_namespace = AWS/EC2 metric_names = ["CPUUtilization","DiskReadOps","StatusCheckFailed_System"] metric_dimensions = [{"InstanceId":"i-e42a8aa9", "Region":"eu-west-1"}] statistics = ["Average","Maximum","Minimum","Sum"] period = 60 polling_interval = 60 sourcetype = aws:cloudwatch queueSize = 128KB persistentQueueSize = 24MB interval = 30 index = aws-cloudwatch </CODE></PRE> Mon, 03 Aug 2015 20:52:24 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Add-on-for-Amazon-Web-Services-Why-am-I-unable-to-get/m-p/153037#M13820 wstallwood 2015-08-03T20:52:24Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Add-on-for-Amazon-Web-Services-Why-am-I-unable-to-get/m-p/153038#M13821 <P>that log says it's getting into the queue okay, but not finding anything there. Can you look at the queue from Amazon's management page and see if there are messages?</P> Sat, 26 Sep 2015 20:53:23 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Add-on-for-Amazon-Web-Services-Why-am-I-unable-to-get/m-p/153038#M13821 jcoates_splunk 2015-09-26T20:53:23Z