Within Splunk Enterprise 7.3.3 we are using AWS App, and the Add-on (4.6.1) mostly successfully. Several inputs work just fine with no issues.
Recently we noticed that the "aws:config" snapshot data is only being partially indexed.
Dumbed down with example numbers:
- We have 20 Lambdas visible in both AWS Console site and AWS:description type in Splunk.
- 15 show up in sourcetype aws:config even after forcing new snapshot.
- Through trial and error we modified the tags on one and it suddenly showed up. We also confirmed through debug that the API response is returning said missing Lambdas, they are just not indexed/searchable.
Is there a set of qualifications/conditions the aws:config input type is filtering the response through before fully indexing? i.e. age of item, last modified, etc.? Any other input or suggestions on forcing all items to be searchable for aws:config sourcetype would be helpful. The aws:description input does not include some fields that we are trying to report on.
