Getting Data In
Highlighted

Splunk Add-on for AWS - cloudwatch inputs.conf

Engager

When adding Cloudwatch inputs for Splunk Add-on for Amazon Web Services using the UI, it appears that in the background, Splunk appends a UUID to the input definition created in inputs.conf under /splunk/etc/apps/SplunkTAaws/local

Example:

[aws_cloudwatch://account_455e6345-ea85-4303-ad60-00f544bf502a]
metric_namespace = AWS/Lambda
[...]
[aws_cloudwatch://account_455e6023-ba56-4303-ad60-00f544bf502a]
metric_namespace = AWS/ApplicationELB
[...]

For Cloudwatch inputs added via Splunk Web, Splunk is able to aggregate all the cloudwatch metric configurations under a single input
alt text

But when we generate inputs.conf with an automation program, appending a generated valid UUID at the end of cloudwatch input names, Splunk creates individual cloudwatch inputs in the UI

Using configuration files, how can we ensure Cloudwatch inputs for a single account are summarised in a single line in the UI, such as when added via UI ?

alt text

0 Karma