All Apps and Add-ons

Splunk Add-on for Amazon Web Services - Custom Data - SQS Based

Path Finder

My ultimate goal is to process csv files directly from an S3 bucket/prefix for splunk to index. I have the Splunk Add-on for Amazon Web Services installed and was attempting to create a new input Custom Data Type using SQS-Based S3. I have a bucket created and I have an SQS created. As I am filling out the AWS Input Configuration info, everything is good until I select the SQS Queue Name. I can see the SQS queue that I created, but when I select it the "Save" button turns grey and I cannot save the configuration. Also, I can no longer select the drop down for the SQS Queue Name as my mouse turns to a red circle with a line through it. I have not been able to figure this out. Any help would be appreciated.

0 Karma


Hi @rkeq0515 

That means you do not have enough permissions towards AWS account to list SQS Queue and other operations advised in add-on docs. Did you check the splunkd and sourcetype=aws:sqs* logs which logs the AWS error behind UI.

0 Karma

Path Finder


Did you figure out the solution for this one. Facing the same issue.

0 Karma

Path Finder

I never got the SQS to work as I had to move forward.  I ended up going with a direct read from the S3 bucket and object, which seemed to work pretty well so far. 


Here is a sample input.conf entry.  

aws_account = s3accountname
bucket_name = testbucket
character_set = auto
ct_blacklist = ^$
host_name =
index = testindex
initial_scan_datetime = 2020-03-01T15:43:47Z
interval = 30
is_secure = True
key_name = csvdata1/
max_items = 100000
max_retries = 3
polling_interval = 60
recursion_depth = -1
sourcetype = aws:s3:testsrctype

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...