Getting Data In

Splunk Add-on for AWS - cloudwatch inputs.conf

mpopescutlpn
Engager

When adding Cloudwatch inputs for Splunk Add-on for Amazon Web Services using the UI, it appears that in the background, Splunk appends a UUID to the input definition created in inputs.conf under /splunk/etc/apps/Splunk_TA_aws/local

Example:

[aws_cloudwatch://account_455e6345-ea85-4303-ad60-00f544bf502a]
metric_namespace = AWS/Lambda
[...]
[aws_cloudwatch://account_455e6023-ba56-4303-ad60-00f544bf502a]
metric_namespace = AWS/ApplicationELB
[...]

For Cloudwatch inputs added via Splunk Web, Splunk is able to aggregate all the cloudwatch metric configurations under a single input
alt text

But when we generate inputs.conf with an automation program, appending a generated valid UUID at the end of cloudwatch input names, Splunk creates individual cloudwatch inputs in the UI

Using configuration files, how can we ensure Cloudwatch inputs for a single account are summarised in a single line in the UI, such as when added via UI ?

alt text

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>