All Apps and Add-ons

S3SPL - No results returned from Ingest Action Bucket

pwoehl
New Member

I am using S3SPL from datapunctum and am trying to get some data to be search.

In the internal index there are no errors logged.

I have setup my ingest actions with .json or .ndjson and also configured my prefix correctly to reflect the timestamp.

I am using minio 

 

 

root@esprimo-piere:/opt/splunk/etc/apps/splunk_ingest_actions/local# cat outputs.conf
[rfs:splunk]
batchSizeThresholdKB = 131072
batchTimeout = 30
compression = none
dropEventsOnUploadError = false
format = json
format.json.index_time_fields = true
format.ndjson.index_time_fields = true
partitionBy = day
path = s3://splunk/
remote.s3.access_key = XXXX
remote.s3.encryption = none
remote.s3.endpoint = https://localhost:9000
remote.s3.secret_key = XXX
remote.s3.signature_version = v4
remote.s3.supports_versioning = false
remote.s3.url_version = v1

 

 

 

root@esprimo-piere:/opt/splunk/etc/apps/SA-DP-s3spl/local# cat s3spl_bucket.conf
[s3spl_bucket://splunk]
aws_access_key = XXXXX
aws_secret_key = ********
bucket_ia = True
bucket_name = splunk
endpoint_url = https://localhost:9000
max_events_per_file = -1
max_files_read = -1
max_total_events = 1000
prefix = /year=${_time:%Y}/month=${_time:%m}/day=${_time:%d}/
timezone = Europe/Berlin
verify_ssl = False

 

 

Screenshot 2024-12-07 234651.png

Screenshot 2024-12-07 235240.png

 

Screenshot 2024-12-07 235354.png

Labels (2)
0 Karma

rajashaey
Explorer

@pwoehl Did this worked? Just curious if its resolved and if you found the solution.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @pwoehl welcome to the community. 

1) This app S3SPL Add-on for Splunk is a new app (at least for me), not sure how to help you. 

2) whatever happens, Splunk should update something to the internal logs.
As you say no internal logs, in this case, looks like something wrong from your configs end. 
3) if i am in your place, best idea i would do is to get some ideas/support from datapunctum directly:

https://docs.datapunctum.com/s3spl/s3spl-faq
4) lets wait for other Splunkers to provide some more ideas, thanks. 

 

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...