Data onboarding issue - Splunk_TA_aws

[smakwana]

Hi,

I am trying to onboard aws access logs from a S3 bucket using the Splunk Add-on for AWS installed in a Heavy Forwarder. There are logs in the location. I am giving a start time stamp as one of the logs. There are more logs in that location, but logs are not getting onboarded into Splunk. I don't see any error logs in _internal logs. 

[thahir · Accepted solution]

@smakwana go to this path $SPLUNK_HOME/var/log/splunk/splunk_ta_aws_s3.log and check if there is any error related to the add on. 

Make sure you gave the correct permission in the AWS end and assigned the List bucket and Get object policy for the S3 bucket.

[smakwana]

Thank you, Thahir

Updated permissions to the role accessing the S3 bucket and that fixed the issue.

[VatsalJagani]

@smakwana - I don't think the given information is enough to understand the issue, given the complexity and variety in AWS inputs. Please provide more details.

* Are you using SQS-based S3 input?

* What are your input settings?

* Is your SQS configured correctly?

* etc