https://community.splunk.com/t5/Getting-Data-In/AWS-Generic-S3-Integration-Error/m-p/519327#M87824 <P>Hi, Following is the basic stanza with minimum settings required in <STRONG>inputs.conf&nbsp; </STRONG>when you use&nbsp;Access Key Id and Secret Access Key.</P><LI-CODE lang="markup">[aws_s3://test_generic_s3] aws_account = TestAWSAccount bucket_name = your-bucket-name sourcetype = aws:s3:cdr index = main host_name = s3.amazonaws.com polling_interval = 3600</LI-CODE><P>File - Splunk_TA_aws/local/passwords.conf should be having your account details stored and encrypted. Same you can find in AWS TA UI section, Configuration -&gt; Accounts. Make sure Account <STRONG>Region Category</STRONG> is <STRONG>Global</STRONG></P><P>If you are using IAM role the stanza is little bit different. What type of Access you have to S3 IAM role/ Access Key id?</P> Mon, 14 Sep 2020 00:54:46 GMT venkatasri 2020-09-14T00:54:46Z https://community.splunk.com/t5/Getting-Data-In/AWS-Generic-S3-Integration-Error/m-p/519121#M87814 <P>I am attempting to use a Generic S3 Bucket with CDR files with multiple folders inside to visualize the data. I am getting the following error and not sure why the account isn't found. In building the source Splunk autofills the values and I can log into S3 with the account. What logs or remediation should I do?</P><P>File "C:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\generic_s3\aws_s3_data_loader.py", line 86, in index_data<BR />self._do_index_data()<BR />File "C:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\generic_s3\aws_s3_data_loader.py", line 107, in _do_index_data<BR />self.collect_data()<BR />File "C:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\generic_s3\aws_s3_data_loader.py", line 153, in collect_data<BR />self._discover_keys(index_store)<BR />File "C:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\generic_s3\aws_s3_data_loader.py", line 223, in _discover_keys<BR />credentials = self._generate_credentials()<BR />File "C:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\generic_s3\aws_s3_data_loader.py", line 384, in _generate_credentials<BR />self._config.get(tac.aws_iam_role),<BR />File "C:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\common\aws_credentials.py", line 158, in load<BR />credentials = self._load(aws_account_name, aws_iam_role_name)<BR />File "C:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\common\aws_credentials.py", line 169, in _load<BR />raise AWSAccountError('account not found', aws_account_name)<BR /><EM><STRONG>splunk_ta_aws.common.aws_credentials.AWSAccountError: account not found</STRONG></EM></P> Fri, 11 Sep 2020 16:06:03 GMT https://community.splunk.com/t5/Getting-Data-In/AWS-Generic-S3-Integration-Error/m-p/519121#M87814 rcrabtree 2020-09-11T16:06:03Z https://community.splunk.com/t5/Getting-Data-In/AWS-Generic-S3-Integration-Error/m-p/519327#M87824 <P>Hi, Following is the basic stanza with minimum settings required in <STRONG>inputs.conf&nbsp; </STRONG>when you use&nbsp;Access Key Id and Secret Access Key.</P><LI-CODE lang="markup">[aws_s3://test_generic_s3] aws_account = TestAWSAccount bucket_name = your-bucket-name sourcetype = aws:s3:cdr index = main host_name = s3.amazonaws.com polling_interval = 3600</LI-CODE><P>File - Splunk_TA_aws/local/passwords.conf should be having your account details stored and encrypted. Same you can find in AWS TA UI section, Configuration -&gt; Accounts. Make sure Account <STRONG>Region Category</STRONG> is <STRONG>Global</STRONG></P><P>If you are using IAM role the stanza is little bit different. What type of Access you have to S3 IAM role/ Access Key id?</P> Mon, 14 Sep 2020 00:54:46 GMT https://community.splunk.com/t5/Getting-Data-In/AWS-Generic-S3-Integration-Error/m-p/519327#M87824 venkatasri 2020-09-14T00:54:46Z