All Apps and Add-ons

Splunk Heavy Forwarder (AWS Add-on for Splunk)

jobayer
New Member

Dear Splunk Community,

I have configured AWS Add-on for Splunk into heavy forwarder. Now when I am sending AWS logs into Search Head Cluster getting following error:

/opt/splunk/var/log/splunk/splunkd.log

07-18-2019 17:27:30.775 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput
07-18-2019 17:28:01.356 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput
07-18-2019 17:28:30.647 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput
07-18-2019 17:29:00.601 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput
07-18-2019 17:29:31.028 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput
07-18-2019 17:30:00.701 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput
07-18-2019 17:30:33.269 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput
07-18-2019 17:31:00.635 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput

Any help highly appreciated.

Regards,
Abdullah Jobayer

0 Karma

dhihoriya_splun
Splunk Employee
Splunk Employee

Hi @jobayer

To work with inputs in Splunk Add-on for AWS on Heavy forwarder you have to first add your AWS account and IAM role with the correct configs (Access Key, Secret Access Key, IAM role arn and all the required information) from which you want to send logs in Splunk. After this setup, all your inputs will identify your AWS account and IAM role and will work smoothly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...