All Apps and Add-ons

Splunk App for AWS: Why does creating a S3 input with nested folder structure not return any results?

ytenenbaum_splu
Splunk Employee
Splunk Employee

A Splunk customer using Splunk App for AWS and they have a problem with the S3 input. They did a few tests to check that the S3 Input is ingesting data and it was able to collect files from a single bucket (.txt files) without any issues. However, when they create an S3 Input and target it to a bucket that contains nested folder structure they're not getting any results, the logs in the buckets do not have any extension as such. They have tried this with ELB Access logs and Cloudtrail logs.

0 Karma
1 Solution

ytenenbaum_splu
Splunk Employee
Splunk Employee

They've solved it by adding a Bucket policy that allows the role to do an S3:GetObject on the Bucket. They overlooked this originally and this is what caused the issue. It appears to be working fine now and they're getting logs coming in nicely.

View solution in original post

ytenenbaum_splu
Splunk Employee
Splunk Employee

They've solved it by adding a Bucket policy that allows the role to do an S3:GetObject on the Bucket. They overlooked this originally and this is what caused the issue. It appears to be working fine now and they're getting logs coming in nicely.

Get Updates on the Splunk Community!

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...