topic Re: Data onboarding issue - Splunk_TA_aws in Getting Data In

Data onboarding issue - Splunk_TA_aws

smakwana — Thu, 13 Nov 2025 21:46:18 GMT

Hi,

I am trying to onboard aws access logs from a S3 bucket using the Splunk Add-on for AWS installed in a Heavy Forwarder. There are logs in the location. I am giving a start time stamp as one of the logs. There are more logs in that location, but logs are not getting onboarded into Splunk. I don't see any error logs in _internal logs.

Re: Data onboarding issue - Splunk_TA_aws

VatsalJagani — Sat, 15 Nov 2025 08:55:50 GMT

@smakwana - I don't think the given information is enough to understand the issue, given the complexity and variety in AWS inputs. Please provide more details.

* Are you using SQS-based S3 input?

* What are your input settings?

* Is your SQS configured correctly?

* etc

Re: Data onboarding issue - Splunk_TA_aws

thahir — Sun, 16 Nov 2025 08:11:51 GMT

@smakwana go to this path $SPLUNK_HOME/var/log/splunk/splunk_ta_aws_s3.log and check if there is any error related to the add on.

Make sure you gave the correct permission in the AWS end and assigned the List bucket and Get object policy for the S3 bucket.

Re: Data onboarding issue - Splunk_TA_aws

smakwana — Wed, 19 Nov 2025 22:15:26 GMT

Thank you, Thahir

Updated permissions to the role accessing the S3 bucket and that fixed the issue.