AWS App - Multiple instances of app on same server. Possible?

[murray_burke]

I have been asked to set up an separate instance of the Splunk App for AWS for each of the AWS environments (Dev, Staging, Prod, etc) within the same Splunk Enterprise deployment. Is it possible to run multiple instances of the AWS app in the same distributed environment?

Currently each of the AWS environments has it's own SQS, ID and Key. I have the aws-cloutrail section working for the Dev environment, but I can't get a new instance of the app (I called it aws-cloudtrail-sandpit) working for the sandpit environment. The AWS sandpit environment app I created creating a new index and data input with the sandpit environment details. Even though I created a new index and data input to point to this index the app for the sandpit environment still displays the data from the Dev environment.

Is there a hard-coded reference to the default "aws-cloudtrail" index somewhere in the app? I have been unable to find out where else this needs to be changed, other than the data input.

To make things harder I don't have access to the AWS environments, but I have been assured that the IAM user has all the required permissions.

Regards,

Murray.

[Lucas_K · Accepted solution]

Its contained with in \SplunkAppforAWS\default\macros.conf

[aws-cloudtrail-index]
definition = index=aws-cloudtrail

You should be able to just create a copy and put it in \SplunkAppforAWS\local\macros.conf and add in any other extra aws indexes you've created using some normal splunk search language.

[aws-cloudtrail-index]
definition = index=aws-cloudtrail*

OR

[aws-cloudtrail-index]
definition = index=aws-cloudtrail OR index=some_other_index

edit: There are also a bunch of hardcoded references within savedsearches.conf also. You'll need to update those. Probably better to replace them with the macro. ie replace "index=aws-cloudtrail" with "aws-cloudtrail-index" which you previously fixed.