https://community.splunk.com/t5/Getting-Data-In/Splunk-Add-on-for-AWS-cloudwatch-inputs-conf/m-p/458001#M79161 <P>When adding Cloudwatch inputs for <A href="https://docs.splunk.com/Documentation/AddOns/released/AWS/Description" target="_blank">Splunk Add-on for Amazon Web Services</A> using the UI, it appears that in the background, Splunk appends a UUID to the input definition created in <STRONG>inputs.conf</STRONG> under <STRONG>/splunk/etc/apps/Splunk_TA_aws/local</STRONG></P> <P><STRONG>Example:</STRONG></P> <PRE><CODE>[aws_cloudwatch://account_455e6345-ea85-4303-ad60-00f544bf502a] metric_namespace = AWS/Lambda [...] [aws_cloudwatch://account_455e6023-ba56-4303-ad60-00f544bf502a] metric_namespace = AWS/ApplicationELB [...] </CODE></PRE> <P>For Cloudwatch inputs added via Splunk Web, Splunk is able to aggregate all the cloudwatch metric configurations under a single input <BR /> <IMG src="https://community.splunk.com/storage/temp/273649-screenshot-2019-05-13-at-124400.png" alt="alt text" /></P> <P>But when we generate inputs.conf with an automation program, appending a generated valid UUID at the end of cloudwatch input names, Splunk creates individual cloudwatch inputs in the UI </P> <P>Using configuration files, how can we ensure Cloudwatch inputs <EM>for a single account</EM> are summarised in a single line in the UI, such as when added via UI ?</P> <P><IMG src="https://community.splunk.com/storage/temp/273650-screenshot-2019-05-13-at-125847.png" alt="alt text" /></P> Wed, 30 Sep 2020 00:33:08 GMT mpopescutlpn 2020-09-30T00:33:08Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Add-on-for-AWS-cloudwatch-inputs-conf/m-p/458001#M79161 <P>When adding Cloudwatch inputs for <A href="https://docs.splunk.com/Documentation/AddOns/released/AWS/Description" target="_blank">Splunk Add-on for Amazon Web Services</A> using the UI, it appears that in the background, Splunk appends a UUID to the input definition created in <STRONG>inputs.conf</STRONG> under <STRONG>/splunk/etc/apps/Splunk_TA_aws/local</STRONG></P> <P><STRONG>Example:</STRONG></P> <PRE><CODE>[aws_cloudwatch://account_455e6345-ea85-4303-ad60-00f544bf502a] metric_namespace = AWS/Lambda [...] [aws_cloudwatch://account_455e6023-ba56-4303-ad60-00f544bf502a] metric_namespace = AWS/ApplicationELB [...] </CODE></PRE> <P>For Cloudwatch inputs added via Splunk Web, Splunk is able to aggregate all the cloudwatch metric configurations under a single input <BR /> <IMG src="https://community.splunk.com/storage/temp/273649-screenshot-2019-05-13-at-124400.png" alt="alt text" /></P> <P>But when we generate inputs.conf with an automation program, appending a generated valid UUID at the end of cloudwatch input names, Splunk creates individual cloudwatch inputs in the UI </P> <P>Using configuration files, how can we ensure Cloudwatch inputs <EM>for a single account</EM> are summarised in a single line in the UI, such as when added via UI ?</P> <P><IMG src="https://community.splunk.com/storage/temp/273650-screenshot-2019-05-13-at-125847.png" alt="alt text" /></P> Wed, 30 Sep 2020 00:33:08 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Add-on-for-AWS-cloudwatch-inputs-conf/m-p/458001#M79161 mpopescutlpn 2020-09-30T00:33:08Z