I made a total of 36 inputs, 12 log groups from various regions. For some reason I do not receive data from the last two log groups in alphabetical order. So I receive logs just fine for all logs starting with an "A" and on, but do not get anything from my last two logs starting with a "P" since they are the last logs in the list. If I change the name of one of the last few inputs by inserting an "A" at the beginning of the name, I receive events from that log group again, but then the next log group gets pushed down the list and I stop receiving events from that one instead. Is this a bug with the AWS add-on?
Can you please file a support ticket so we can diagnose this behavior?
We have not purchased Splunk as of yet. Inputting a ticket will definitely be one of the first things we do if a future update doesn't fix this by then 🙂