If I click through the Data Summary box and select sourcetype = cloudwatch, I receive the following error message from my indexers:
Failed to find a valid configuration for multikv stanza = 'tsv_cloudwatch'
The problem here is because the multikv.conf file that is located in the Splunk_TA_aws does not exist on the indexer. In this case, it was only installed on the search head.
To remove the error, either install the Splunk_TA_aws on the indexer or copy the multikv.conf file located in etc/apps/Splunk_TA_aws/default from the search head to the indexer and then restart the splunk service.
The problem here is because the multikv.conf file that is located in the Splunk_TA_aws does not exist on the indexer. In this case, it was only installed on the search head.
To remove the error, either install the Splunk_TA_aws on the indexer or copy the multikv.conf file located in etc/apps/Splunk_TA_aws/default from the search head to the indexer and then restart the splunk service.