All Apps and Add-ons

Splunk Add-On for AWS: should I use 1 or many SQS for the various inputs?

lhanich1
Path Finder

I am currently utilizing SQS ingestion for all the inputs within the app. I am noticing some duplicity with the sources indexing across 2 different indexes. Should I be using a different SQS for each input? As of now, we are using 1 SQS stream across all the inputs within the Splunk Add On for AWS.

Thanks

0 Karma

amiracle
Splunk Employee
Splunk Employee

What are the two indexes you are seeing the data flow into? By default the add-on will write the data to the main or default index. Then the saved searches will summarize some of the data and put them into summary indexes. That is normal behavior, so before you stop ingesting data, let's make sure you're not looking at both the summary and default indexes.

0 Karma

lhanich1
Path Finder

Every Input is designated to its rightful index so it is not all dumping into 1 index.

0 Karma