https://community.splunk.com/t5/Splunk-Enterprise/How-to-forward-the-data-from-AWS-S3-to-Splunk-Enterprise/m-p/669424#M17902 <P>I have installed a free version of Splunk Enterprise 9.1 in my local system. I would need few logs files from my S3 bucket to be sent to Splunk.</P><P>I have setup up the Splunk Add-on for AWS. In the app, under configuration, created an account with access ID and secret access key. Then created an input by specifying the account name, bucket name and indexing details.</P><P class="">After creating the input, when I search my index and sourcetype, I could not find the logs from S3. I have waited for more than half an hour, then tried again but no luck.</P><P class="">As this is the first time I am trying the setup with AWS add-on, I am not sure whether the issue is happening. Could anyone please help me on this?</P> Wed, 22 Nov 2023 07:43:34 GMT akarivaratharaj 2023-11-22T07:43:34Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-forward-the-data-from-AWS-S3-to-Splunk-Enterprise/m-p/669424#M17902 <P>I have installed a free version of Splunk Enterprise 9.1 in my local system. I would need few logs files from my S3 bucket to be sent to Splunk.</P><P>I have setup up the Splunk Add-on for AWS. In the app, under configuration, created an account with access ID and secret access key. Then created an input by specifying the account name, bucket name and indexing details.</P><P class="">After creating the input, when I search my index and sourcetype, I could not find the logs from S3. I have waited for more than half an hour, then tried again but no luck.</P><P class="">As this is the first time I am trying the setup with AWS add-on, I am not sure whether the issue is happening. Could anyone please help me on this?</P> Wed, 22 Nov 2023 07:43:34 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-forward-the-data-from-AWS-S3-to-Splunk-Enterprise/m-p/669424#M17902 akarivaratharaj 2023-11-22T07:43:34Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-forward-the-data-from-AWS-S3-to-Splunk-Enterprise/m-p/669430#M17903 <P>Please check the aws s3 logs in the splunk end it may be due to permission issue from aws end. Once you go through the logs you will get clear visibility.&nbsp; the logs will be under /opt/splunk/var/log/splunk and serach for aws.</P> Wed, 22 Nov 2023 08:59:51 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-forward-the-data-from-AWS-S3-to-Splunk-Enterprise/m-p/669430#M17903 thahir 2023-11-22T08:59:51Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-forward-the-data-from-AWS-S3-to-Splunk-Enterprise/m-p/669442#M17905 <P>Yes, there was some error with endpoint. I have checked the error via below query</P><LI-CODE lang="markup">index=_internal sourcetype=aws:s3:log ERROR</LI-CODE> Wed, 22 Nov 2023 10:09:13 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-forward-the-data-from-AWS-S3-to-Splunk-Enterprise/m-p/669442#M17905 akarivaratharaj 2023-11-22T10:09:13Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-forward-the-data-from-AWS-S3-to-Splunk-Enterprise/m-p/669443#M17906 <P>I am curious to know about a couple of things related to fetching S3 logs.</P><UL><LI>Is there any limitation in the number of inputs which we create in the AWS add-on?</LI><LI>Is there any limitation on indexes on which we log the S3 data?</LI></UL> Wed, 22 Nov 2023 10:11:15 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-forward-the-data-from-AWS-S3-to-Splunk-Enterprise/m-p/669443#M17906 akarivaratharaj 2023-11-22T10:11:15Z