All Apps and Add-ons

AWS Splunk add-on - Billing Data Input

Stokers_23
Explorer

Hi

I'm trying to setup a simple input to ingest our AWS billing data into Splunk. Our AWS billing data is stored in an S3 bucket in our parent AWS account, the Splunk HF and indexer are in another 'non prod' account which we access via switch roles.

In order to pull the data into Splunk I have configured a role in the parent account and allowed the EC2 role applied to the Splunk instance, permissions to assume it. However when I configure the Input via the AWS add on I get the following error when it tries to return a list of buckets ' Error in processing the request'

I've tested calling the sts:assumerole operation from the splunk server and I can access the bucket with no problems. So i'm reasonably confident it's not connectivity or permissions. I also can't seem to find any kind of logs to provide further detail on what the issue is - I have checked

var/log/splunk/splunk_ta_aws_aws_billing_cur_AwsBilling.log . (i've also tried setting the logging level to ERROR and DEBUG
var/log/splunk/splunkd.log

However I can't find any errors at all, can anyone advise how we might debug this further?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...