The splunkd.log indicates repeated WARN's entries of the form:
02-23-2016 10:36:56.156 +0000 WARN DateParserVerbose - A possible timestamp match (Mon Sep 11 04:05:51 2000) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::eu-west-1:FlowLogs/vpc-xxxxxxx:eni-0ba23051-all|host::ourhost.com|aws:cloudwatchlogs:vpcflow|
Other AWS input is being received correctly e.g. Billing, Description, Config
This is a clear indication that the events that you are sending into Splunk are mis-timestamped. Splunk will only allow timestamps to deviate from "now" by a few days forwards (default is 2) or backwards (default is 2000). If the timestamp that splunk identifies inside of your event it outside of this window, the event will be given
You need to take a look at your timestamp configuration definitions in props.conf and compare them with your events. If this is correct, then you need to make sure that you do not have a timezone issue.