All Apps and Add-ons

Only Partial AWS Config Data Indexed

JamesM
New Member
Within Splunk Enterprise 7.3.3 we are using AWS App,  and  the Add-on (4.6.1) mostly successfully. Several inputs work just fine with no issues.
Recently we noticed that the "aws:config" snapshot data is only being partially indexed. 
Dumbed down with example numbers:
  •   We have 20 Lambdas visible in both AWS Console site and  AWS:description type in Splunk.
  •   15 show up in sourcetype aws:config even after forcing new snapshot.
  •   Through trial and error we modified the tags on one and it suddenly showed up. We also confirmed through debug that the API response is returning said missing Lambdas, they are just not indexed/searchable.
Is there a set of qualifications/conditions the aws:config input type is filtering the response through before fully indexing? i.e. age of item, last modified, etc.? Any other input or suggestions on forcing all items to be searchable for aws:config sourcetype would be helpful. The aws:description input does not include some fields that we are trying to report on.
Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...