https://community.splunk.com/t5/All-Apps-and-Add-ons/AWS-App-Multiple-instances-of-app-on-same-server-Possible/m-p/194356#M20052 <P>Its contained with in <CODE>\SplunkAppforAWS\default\macros.conf</CODE></P> <PRE><CODE>[aws-cloudtrail-index] definition = index=aws-cloudtrail </CODE></PRE> <P>You should be able to just create a copy and put it in <CODE>\SplunkAppforAWS\local\macros.conf</CODE> and add in any other extra aws indexes you've created using some normal splunk search language.</P> <PRE><CODE>[aws-cloudtrail-index] definition = index=aws-cloudtrail* </CODE></PRE> <P>OR</P> <PRE><CODE>[aws-cloudtrail-index] definition = index=aws-cloudtrail OR index=some_other_index </CODE></PRE> <P>edit: There are also a bunch of hardcoded references within savedsearches.conf also. You'll need to update those. Probably better to replace them with the macro. ie replace "index=aws-cloudtrail" with "<CODE>aws-cloudtrail-index</CODE>" which you previously fixed.</P> Tue, 11 Nov 2014 06:14:06 GMT Lucas_K 2014-11-11T06:14:06Z https://community.splunk.com/t5/All-Apps-and-Add-ons/AWS-App-Multiple-instances-of-app-on-same-server-Possible/m-p/194355#M20051 <P>I have been asked to set up an separate instance of the Splunk App for AWS for each of the AWS environments (Dev, Staging, Prod, etc) within the same Splunk Enterprise deployment. Is it possible to run multiple instances of the AWS app in the same distributed environment?</P> <P>Currently each of the AWS environments has it's own SQS, ID and Key. I have the aws-cloutrail section working for the Dev environment, but I can't get a new instance of the app (I called it aws-cloudtrail-sandpit) working for the sandpit environment. The AWS sandpit environment app I created creating a new index and data input with the sandpit environment details. Even though I created a new index and data input to point to this index the app for the sandpit environment still displays the data from the Dev environment.</P> <P>Is there a hard-coded reference to the default "aws-cloudtrail" index somewhere in the app? I have been unable to find out where else this needs to be changed, other than the data input.</P> <P>To make things harder I don't have access to the AWS environments, but I have been assured that the IAM user has all the required permissions.</P> <P>Regards,</P> <P>Murray.</P> Thu, 06 Nov 2014 03:48:06 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/AWS-App-Multiple-instances-of-app-on-same-server-Possible/m-p/194355#M20051 murray_burke 2014-11-06T03:48:06Z https://community.splunk.com/t5/All-Apps-and-Add-ons/AWS-App-Multiple-instances-of-app-on-same-server-Possible/m-p/194356#M20052 <P>Its contained with in <CODE>\SplunkAppforAWS\default\macros.conf</CODE></P> <PRE><CODE>[aws-cloudtrail-index] definition = index=aws-cloudtrail </CODE></PRE> <P>You should be able to just create a copy and put it in <CODE>\SplunkAppforAWS\local\macros.conf</CODE> and add in any other extra aws indexes you've created using some normal splunk search language.</P> <PRE><CODE>[aws-cloudtrail-index] definition = index=aws-cloudtrail* </CODE></PRE> <P>OR</P> <PRE><CODE>[aws-cloudtrail-index] definition = index=aws-cloudtrail OR index=some_other_index </CODE></PRE> <P>edit: There are also a bunch of hardcoded references within savedsearches.conf also. You'll need to update those. Probably better to replace them with the macro. ie replace "index=aws-cloudtrail" with "<CODE>aws-cloudtrail-index</CODE>" which you previously fixed.</P> Tue, 11 Nov 2014 06:14:06 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/AWS-App-Multiple-instances-of-app-on-same-server-Possible/m-p/194356#M20052 Lucas_K 2014-11-11T06:14:06Z