All Apps and Add-ons

IT Essentials App

drggfish
Engager

Hello - I just moved my Splunk deployment to AWS and installed a couple of apps - (1) Splunk App for AWS and (2) IT Essentials.

In several of the IT Essentials built in queries it is referencing:

sourcetype="aws:description"

Where is this sourcetype coming from?

Thanks,

Greg

Labels (2)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @drggfish 

The aws:description sourcetype comes from the Splunk Add-on for Amazon Web Services (AWS)

However, Splunk Add-on for AWS has deprecated the usage of the aws:description source type and currently supports the use of the aws:metadata source type to get data in for versions 6.0.0 or later. For more information, see the documentation about the different source types that Splunk Add-on for AWS supports in Source types for the Splunk Add-on for AWS.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

drggfish
Engager

Thanks!

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @drggfish 

The aws:description sourcetype comes from the Splunk Add-on for Amazon Web Services (AWS)

However, Splunk Add-on for AWS has deprecated the usage of the aws:description source type and currently supports the use of the aws:metadata source type to get data in for versions 6.0.0 or later. For more information, see the documentation about the different source types that Splunk Add-on for AWS supports in Source types for the Splunk Add-on for AWS.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...