Why is AWS Billing failing with "there's no any timestamp column in header" after moving the Splunk App for AWS from the search head to the heavy forwarder?

[cwyse]

We configured AWS billing on the aws app. Things worked fine until we moved the app from the search head to the heavy forwarder. Now we are seeing a lot of failures with the following error:

  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_billing.py", line 896, in _stream_monthly_billing_item
    raise Exception("there's no any timestamp column in header")
Exception: there's no any timestamp column in header

I copied the inputs over from the working system so nothing should have changed. I do see the errors on existing files. So I'm not sure why it can't find the timestamp anymore.

[jcoates_splunk · Accepted solution]

following up from offline conversation -- the default conf files needed to be copied over too.