All Apps and Add-ons

Why is the Splunk Add-on for Amazon Web Services not working and discarding events?

sean_kcg
New Member

I have the aws configured with the app. I am able to pull from some buckets, but not others. I see the following in the logs. I am not sure why it is discarding events. Any ideas?

NFO pid=22464 tid=MainThread file=aws_cloudtrail.py:process_CT_notifications:634 | fetched 520 records, wrote 0, discarded 520, redirected 0 from s3:aws-hhs-cms-oc-cloudtrail/AWSLogs/.../CloudTrail/us-east-1/2015/05/28/..._CloudTrail_us-east-1_20150528T0150Z_arraztklBqzeCN6r.json.gz
2015-05-27 21:53:53,814 INFO pid=22464 tid=MainThread file=aws_cloudtrail.py:stream_events:328 | 1 completed, 0 failed while processing a notification batch of 1 [0 errors deleting 1 notifications]  Elapsed: 0.981s
0 Karma

jacobwilkins
Communicator

Look at your inputs.conf stanza for your clouldtrail input.

Does it have this:

exclude_describe_events = 1

That is the default. If so, then what you are seeing is expected behavior. You'll pull down, parse, and discard all your "describe" events. You'll only index events that describe changes.

zoeygirl45
Explorer

Yes, my settings are set to 1, is this a recommended setting?

0 Karma

zoeygirl45
Explorer

Thank you, I will check and post findings.

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...