Splunk Heavy Forwarder (AWS Add-on for Splunk)

[jobayer]

Dear Splunk Community,

I have configured AWS Add-on for Splunk into heavy forwarder. Now when I am sending AWS logs into Search Head Cluster getting following error:

/opt/splunk/var/log/splunk/splunkd.log

07-18-2019 17:27:30.775 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput
07-18-2019 17:28:01.356 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput
07-18-2019 17:28:30.647 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput
07-18-2019 17:29:00.601 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput
07-18-2019 17:29:31.028 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput
07-18-2019 17:30:00.701 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput
07-18-2019 17:30:33.269 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput
07-18-2019 17:31:00.635 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_cloudtrail.py" ERRORAWS account not found for datainput

Any help highly appreciated.

Regards,
Abdullah Jobayer

[dhihoriya_splun]

Hi @jobayer

To work with inputs in Splunk Add-on for AWS on Heavy forwarder you have to first add your AWS account and IAM role with the correct configs (Access Key, Secret Access Key, IAM role arn and all the required information) from which you want to send logs in Splunk. After this setup, all your inputs will identify your AWS account and IAM role and will work smoothly.