Do the Splunk App for AWS and Splunk Add-On for Amazon Web Services work with Splunk free?

[mvdp]

I am using Splunk Free Enterprise, and have had a ton of difficulty in getting data from AWS Cloudwatch into the Splunk Add-On for Amazon Web Services. In addition, the Splunk App for AWS simply doesn't work with the add-on. I can see events in the add-on for the AWS/EC2 namespace, and yet the app has 0 for everything. My inputs are going to the "main" index, not anything special. And I am only collecting from the "InstanceId" dimension for EC2 (as I saw a post earlier saying the others wouldn't work)

So, do they actually work in the free enterprise version? Is there something I need to set up to help the two parts communicate?

[nickhills]

You need to install the Splunk_TA_aws.
The app just does the vis and saved searches. The TA collects the actual data from the AWS webservices.

[mvdp]

Yes, I have both the Splunk add-on for AWS (where I can see events for the EC2 data) and the Splunk App for AWS (which won't communicate with the add-on to get the data to display it).

[nickhills]

In the most recent version of the AWS app 5.1.0 the app no longer 'communicates' with the TA like it did in previous versions. Instead you perform all of the input config in the TA, and switch to the app to view it. As an aside, if your using AWS config - the TA no longer generates a config snapshot for you - you will have to trigger the API to do this for you, and there is no mention of this in the documentation (I have raised this with support!).

I am not sure what data you would be trying to collect, but the bulk of the useful information comes from the Config and cloud trail services. The app uses those historical audit and activity sources to populate most of the dashboards. Its not talking directly to the ec2 endpoints to get performance or machine data data.

[nickhills]

Oh - also, have you enabled the summary saved searches on the TA - these take your TA configured inputs and write them into a summary index. The app then uses the results from the summary index to pass to the other saved searches which generate the data.

[mvdp]

Thanks, that's good to know! I was only collecting EC2 metrics from AWS cloudwatch, so maybe that's the problem. I will try collecting from Config and Cloudtrail too and see what happens. I have the "Addon Metadata - Summarize AWS Inputs" enabled. Is that what you mean by the summary saved search? (I'm rather new to Splunk)

[nickhills]

thats the one!

[mvdp]

Ok, thanks for your help! I did a quick search on the summary index and it appears to be working so I'll try adding the other inputs and go from there 🙂

[woodcock]

Yes. Those are totally free apps. They would only not work on free if some feature depended on either license stacking (definitely not) or on clustering (surely not).

[Esky73]

I'm reading that Q as .. yes the apps are free .. but do they work on the limited free version of Splunk ?

[mvdp]

Thanks for the comments Woodcock and Esky73. I have gone through the documentation and tried a lot of different things to get the data from the add-on into the app and nothing has worked.

Do you know if I have to be collecting all of the Cloudwatch data, not just the EC2 data for the app to work? I would have thought that I could see the EC2 data in the AWS App without having to get the ELB, billing. RDS etc. data. Or is there something special that needs to be configured and is undocumented?

On the configuration page in the App for AWS, I have no options to do anything other than a few checkboxes to enable warning messages and a button to select billing tags.