All Apps and Add-ons

How to reingest missing Cloudwatch Input Logs

sharte
Explorer

Apologies if already asked but I was unable to find something, So it was noticed this morning that one of our aws:cloudwatch inputs on Splunk Add on for Aws 4.60 had stopped forwarding logs since the 21st of August, once the input was recreated it started pulling the fresh logs from that moment on wards.

I am looking to ingest the missing 15 days or so of data but am unable to identify how to achieve this.

Any help is much appreciated.
I have tried setting a new input with the setting:
query_window_size = 20160 but I am not seeing any success from this,

Current Application: Splunk Add-on for AWS
App Version
4.6.0
App Build
8
Thanks

0 Karma
1 Solution

KranthiGhanta
Engager

Hi @sharte,

If you are having a cloudwatch log group for your data, it can be easy, you can use this method here https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3ExportTasksConsole.html and from S3 bucket , you can grab the data into splunk using AWS-Addon app

hope it could help you,

View solution in original post

KranthiGhanta
Engager

Hi @sharte,

If you are having a cloudwatch log group for your data, it can be easy, you can use this method here https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3ExportTasksConsole.html and from S3 bucket , you can grab the data into splunk using AWS-Addon app

hope it could help you,

sharte
Explorer

Thanks for your suggestion, unfortunately it didn't help in the original case, as our cloudwatch data was that was missing had aged out, but I have made use since with another issue.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...