All Apps and Add-ons

S3SPL - No results returned from Ingest Action Bucket

pwoehl
New Member

I am using S3SPL from datapunctum and am trying to get some data to be search.

In the internal index there are no errors logged.

I have setup my ingest actions with .json or .ndjson and also configured my prefix correctly to reflect the timestamp.

I am using minio 

 

 

root@esprimo-piere:/opt/splunk/etc/apps/splunk_ingest_actions/local# cat outputs.conf
[rfs:splunk]
batchSizeThresholdKB = 131072
batchTimeout = 30
compression = none
dropEventsOnUploadError = false
format = json
format.json.index_time_fields = true
format.ndjson.index_time_fields = true
partitionBy = day
path = s3://splunk/
remote.s3.access_key = XXXX
remote.s3.encryption = none
remote.s3.endpoint = https://localhost:9000
remote.s3.secret_key = XXX
remote.s3.signature_version = v4
remote.s3.supports_versioning = false
remote.s3.url_version = v1

 

 

 

root@esprimo-piere:/opt/splunk/etc/apps/SA-DP-s3spl/local# cat s3spl_bucket.conf
[s3spl_bucket://splunk]
aws_access_key = XXXXX
aws_secret_key = ********
bucket_ia = True
bucket_name = splunk
endpoint_url = https://localhost:9000
max_events_per_file = -1
max_files_read = -1
max_total_events = 1000
prefix = /year=${_time:%Y}/month=${_time:%m}/day=${_time:%d}/
timezone = Europe/Berlin
verify_ssl = False

 

 

Screenshot 2024-12-07 234651.png

Screenshot 2024-12-07 235240.png

 

Screenshot 2024-12-07 235354.png

Labels (2)
0 Karma

rajashaey
Explorer

@pwoehl Did this worked? Just curious if its resolved and if you found the solution.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @pwoehl welcome to the community. 

1) This app S3SPL Add-on for Splunk is a new app (at least for me), not sure how to help you. 

2) whatever happens, Splunk should update something to the internal logs.
As you say no internal logs, in this case, looks like something wrong from your configs end. 
3) if i am in your place, best idea i would do is to get some ideas/support from datapunctum directly:

https://docs.datapunctum.com/s3spl/s3spl-faq
4) lets wait for other Splunkers to provide some more ideas, thanks. 

 

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...