topic Re: Does the AWS add-on actually work in Splunk Light? in All Apps and Add-ons

Does the AWS add-on actually work in Splunk Light?

labkey_mikeb — Mon, 25 Sep 2017 20:21:36 GMT

Hello,

I'm evaluating Splunk Light for some light-weight log parsing. One of the needs I have is the ability to monitor resources in AWS.

To that end, I installed the Splunk App for AWS and the Splunk Add-On for Amazon Web Services.

When trying to follow the instructions for configuring accounts, after clicking "Configure", I am presented with a screen that has a single button for "Billing" (Select billing tag) on it and a row of check-boxes for "Warning Message Settings". There is no option to set up an account or any other configurable option.

Looking in the Splunk errors, I see that AdminManageExternal is not supported by Splunk Light.

I'm not sure if the two are related or not., but I cannot figure out how to set up an Splunk Light to use an AWS account so I can starting inputting data from AWS.

Any help would be greatly appreciated.

Re: Does the AWS add-on actually work in Splunk Light?

labkey_mikeb — Mon, 25 Sep 2017 21:32:40 GMT

Hello,

Thank you for your prompt reply. Sadly, even after following the directions above, I'm still stuck in the same place where I cannot enter an account under "Configuration" because the option to do so isn't presented to me. Attached is the screen that I see when I try to use the "Configure" option.

(Well, I would attach an image, but apparently I don't have enough "Karma Points" to do such.)

-- Mike Beebe

Re: Does the AWS add-on actually work in Splunk Light?

gneumann_splunk — Tue, 29 Sep 2020 15:56:38 GMT

Where did you get your version of Splunk Light? Is it a trial version from Splunk.com, or did you install the Splunk Light AMI version from the AWS Marketplace for Splunk products?

The reason I ask is if you get your Splunk Light AMI version, now "Splunk Insights for AWS Cloud Monitoring AMI", the AWS app and add-on are pre-installed. See https://aws.amazon.com/marketplace/pp/B015ZG2196?qid=1506376905168&sr=0-2&ref_=srh_res_product_title. You might not have the issues you are currently having. It seems something might be wrong with the configuration of the AWS app and add-on in your current instance?

Re: Does the AWS add-on actually work in Splunk Light?

labkey_mikeb — Mon, 25 Sep 2017 22:32:29 GMT

Hello again,

I'm using a standalone evaluation of Splunk Light downloaded from Splunk and running on its own server. Sadly, it would be impossible for us to move this to AWS due to HIPAA and business requirements.

Thanks for looking into this,

-- Mike Beebe

Re: Does the AWS add-on actually work in Splunk Light?

gneumann_splunk — Mon, 25 Sep 2017 22:44:16 GMT

It should work for you, using the version you have from Splunk.com.

I'll look further into this tomorrow, and also inquire to some people that might help troubleshoot. Hoping to get you up and running.

Re: Does the AWS add-on actually work in Splunk Light?

labkey_mikeb — Tue, 26 Sep 2017 14:57:32 GMT

Hello,

Thanks -- I very much appreciate the help. I've used Splunk Enterprise before in a larger environment and have always been impressed with its capabilities. However, in order to sell Enterprise to management here, I'm going to need Splunk Light to "Proof of Concept".

-- Mike Beebe

Re: Does the AWS add-on actually work in Splunk Light?

gneumann_splunk — Tue, 26 Sep 2017 20:52:09 GMT

Hi Mike, Can you email me a screenshot of the issue you are having. Also, I have some other resources for you that might be helpful.
Thanks,
gneumann@splunk.com

Re: Does the AWS add-on actually work in Splunk Light?

networkthinking — Sat, 30 Sep 2017 16:54:19 GMT

Hello,
Anyone come up with an answer on this?

Re: Does the AWS add-on actually work in Splunk Light?

networkthinking — Sat, 30 Sep 2017 17:57:20 GMT

I am having same issue. We had three accounts and was going to add more this morning when I was prompted to install updates for Splunk AWS. After I installed it I had same error as you.

I also decided to try Splunk Cloud to see if I had same issue. Immediate after installing the AWS apps I was unable to add accounts. I have a feeling new version of AWS app is breaking cloud and light versions.

Re: Does the AWS add-on actually work in Splunk Light?

gneumann_splunk — Sun, 01 Oct 2017 16:15:39 GMT

Looking into this issue, and will post findings after a bit more research.

Re: Does the AWS add-on actually work in Splunk Light?

gneumann_splunk — Mon, 02 Oct 2017 20:51:53 GMT

To resolve this issue, it's best to log a Support ticket at this time. Go to www.splunk.com and click Support > Support Portal in upper right. Thanks.

Re: Does the AWS add-on actually work in Splunk Light?

networkthinking — Mon, 02 Oct 2017 20:54:58 GMT

Thanks. We opened case 548415 this weekend and waiting for update from Splunk.

Re: Does the AWS add-on actually work in Splunk Light?

networkthinking — Tue, 03 Oct 2017 14:08:52 GMT

I heard back from Support but appears that person is not familiar with the Splunk App for AWS. We will wait to see if we can get any resolution to this. I am starting to get the feeling this is not something considered Production or used very widely. Not sure how there can only be two of us reporting this .

Re: Does the AWS add-on actually work in Splunk Light?

ehaddad_splunk — Wed, 04 Oct 2017 05:06:06 GMT

Ok If you are using Splunk Add-on for AWS v4.4.0 and v5.1.0 version of the app - the configuration has to be done in the add-on and No longer allowed in the Splunk App in AWS. What you have described as behavior for the configuration tab is expected and it looks like you are doing the configuration in app.
Can you please confirm if you are having issues doing the configuration on the add-on instead?

Re: Does the AWS add-on actually work in Splunk Light?

networkthinking — Wed, 04 Oct 2017 16:43:52 GMT

We have been using the Splunk App for AWS and clicking the Config button. The Config button does not seem to work anymore in Cloud or Light since 5.1

Do you have document on how to add data to Splunk using AWS? I looked around in the Splunk Add-on and could not find a space to add our accounts

Please advise or share document on how this has changed so we can get our data into Splunk Light or Cloud.

Re: Does the AWS add-on actually work in Splunk Light?

networkthinking — Wed, 04 Oct 2017 22:51:06 GMT

I checked this document and still shows to use the Configure button
http://docs.splunk.com/Documentation/SplunkLight/6.6.3/Installation/GettingstartedSplunkAppforAWS#

Is there a new doc we should be using?

Step 4: In Splunk Light, add your AWS account and configure data sources
In your Splunk Light instance, add at least one AWS account to use for data collection, and configure your data sources (inputs) to get your AWS data into Splunk Light. You will need your AWS Account Access Key ID and AWS Secret Access Key. Splunk suggests you configure all the data sources listed to populate all dashboards. Each data source has instructions in the user dialog about how to add and configure the input.

Add your AWS account to your Splunk Light instance. a. In Splunk Light, go to the App for AWS page and click Configure. b. Under Accounts, click Add AWS Account. c. Enter a friendly name. d. Add your AWS Account Access Key ID. e. Add your AWS Secret Access Key. f. Click Add.

Re: Does the AWS add-on actually work in Splunk Light?

gneumann_splunk — Thu, 05 Oct 2017 04:24:18 GMT

The configuration for adding AWS accounts is now through the Add-on for AWS, from the Data>Data Input page in Splunk Light. I'm working on a doc update and it should be available in the next day or so after information is confirmed.

Re: Does the AWS add-on actually work in Splunk Light?

networkthinking — Thu, 05 Oct 2017 04:33:43 GMT

Gayle - I found the screen you are referencing but not sure which option to choose to add the AWS account. Can you add that here so we can move forward? We have been stuck since Friday on this and our ticket is not being touched in the support system.

What about in Splunk Cloud. It is also different since the Config button no longer works.

Re: Does the AWS add-on actually work in Splunk Light?

gneumann_splunk — Thu, 05 Oct 2017 04:45:58 GMT

I just sent you an email.

Re: Does the AWS add-on actually work in Splunk Light?

gneumann_splunk — Thu, 05 Oct 2017 05:17:17 GMT

For Splunk Light 7.0, these work-around steps should guide you in adding an AWS account and configuring services.

In Splunk Light, click the hamburger icon in the left menu tree and select Data > Apps and Add-ons
Under the "Splunk Add-on for AWS" click the Open button
Click the Add Data button under the "Data" section in the right of the screen
Click the Configuration menu in the top menu bar
Add the required AWS accounts by clicking on the Add button
Click the "back" browser button – which brings you back to the "Add Data" page
Click the Inputs menu in the top menu bar
Add the required inputs by clicking the Create New Input button in the right of the screen.

See the Learn more link within the dialog, or Inputs overview for the Splunk App for AWS for information about specific data sources.