All Apps and Add-ons

How to reingest missing Cloudwatch Input Logs

Explorer

Apologies if already asked but I was unable to find something, So it was noticed this morning that one of our aws:cloudwatch inputs on Splunk Add on for Aws 4.60 had stopped forwarding logs since the 21st of August, once the input was recreated it started pulling the fresh logs from that moment on wards.

I am looking to ingest the missing 15 days or so of data but am unable to identify how to achieve this.

Any help is much appreciated.
I have tried setting a new input with the setting:
query_window_size = 20160 but I am not seeing any success from this,

Current Application: Splunk Add-on for AWS
App Version
4.6.0
App Build
8
Thanks

0 Karma
1 Solution

Hi @sharte,

If you are having a cloudwatch log group for your data, it can be easy, you can use this method here https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3ExportTasksConsole.html and from S3 bucket , you can grab the data into splunk using AWS-Addon app

hope it could help you,

View solution in original post

Hi @sharte,

If you are having a cloudwatch log group for your data, it can be easy, you can use this method here https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3ExportTasksConsole.html and from S3 bucket , you can grab the data into splunk using AWS-Addon app

hope it could help you,

View solution in original post

Explorer

Thanks for your suggestion, unfortunately it didn't help in the original case, as our cloudwatch data was that was missing had aged out, but I have made use since with another issue.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!