https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Heavy-Forwarder-AWS-Add-on-for-Splunk/m-p/399846#M48786 <P>Hi @jobayer </P> <P>To work with inputs in Splunk Add-on for AWS on Heavy forwarder you have to first add your AWS account and IAM role with the correct configs (Access Key, Secret Access Key, IAM role arn and all the required information) from which you want to send logs in Splunk. After this setup, all your inputs will identify your AWS account and IAM role and will work smoothly.</P> Wed, 14 Aug 2019 04:07:55 GMT dhihoriya_splun 2019-08-14T04:07:55Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Heavy-Forwarder-AWS-Add-on-for-Splunk/m-p/399845#M48785 <P>Dear Splunk Community,</P> <P>I have configured AWS Add-on for Splunk into heavy forwarder. Now when I am sending AWS logs into Search Head Cluster getting following error:</P> <P>/opt/splunk/var/log/splunk/splunkd.log</P> <P>07-18-2019 17:27:30.775 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput<BR /> 07-18-2019 17:28:01.356 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput<BR /> 07-18-2019 17:28:30.647 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput<BR /> 07-18-2019 17:29:00.601 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput<BR /> 07-18-2019 17:29:31.028 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput<BR /> 07-18-2019 17:30:00.701 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput<BR /> 07-18-2019 17:30:33.269 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput<BR /> 07-18-2019 17:31:00.635 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput</P> <P>Any help highly appreciated.</P> <P>Regards,<BR /> Abdullah Jobayer</P> Wed, 30 Sep 2020 01:24:30 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Heavy-Forwarder-AWS-Add-on-for-Splunk/m-p/399845#M48785 jobayer 2020-09-30T01:24:30Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Heavy-Forwarder-AWS-Add-on-for-Splunk/m-p/399846#M48786 <P>Hi @jobayer </P> <P>To work with inputs in Splunk Add-on for AWS on Heavy forwarder you have to first add your AWS account and IAM role with the correct configs (Access Key, Secret Access Key, IAM role arn and all the required information) from which you want to send logs in Splunk. After this setup, all your inputs will identify your AWS account and IAM role and will work smoothly.</P> Wed, 14 Aug 2019 04:07:55 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Heavy-Forwarder-AWS-Add-on-for-Splunk/m-p/399846#M48786 dhihoriya_splun 2019-08-14T04:07:55Z