All Apps and Add-ons

Splunk Add-On for AWS: should I use 1 or many SQS for the various inputs?

lhanich1
Path Finder

I am currently utilizing SQS ingestion for all the inputs within the app. I am noticing some duplicity with the sources indexing across 2 different indexes. Should I be using a different SQS for each input? As of now, we are using 1 SQS stream across all the inputs within the Splunk Add On for AWS.

Thanks

0 Karma

amiracle
Splunk Employee
Splunk Employee

What are the two indexes you are seeing the data flow into? By default the add-on will write the data to the main or default index. Then the saved searches will summarize some of the data and put them into summary indexes. That is normal behavior, so before you stop ingesting data, let's make sure you're not looking at both the summary and default indexes.

0 Karma

lhanich1
Path Finder

Every Input is designated to its rightful index so it is not all dumping into 1 index.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...