Getting Data In

Splunk Add-on for AWS - cloudwatch inputs.conf

mpopescutlpn
Engager

When adding Cloudwatch inputs for Splunk Add-on for Amazon Web Services using the UI, it appears that in the background, Splunk appends a UUID to the input definition created in inputs.conf under /splunk/etc/apps/Splunk_TA_aws/local

Example:

[aws_cloudwatch://account_455e6345-ea85-4303-ad60-00f544bf502a]
metric_namespace = AWS/Lambda
[...]
[aws_cloudwatch://account_455e6023-ba56-4303-ad60-00f544bf502a]
metric_namespace = AWS/ApplicationELB
[...]

For Cloudwatch inputs added via Splunk Web, Splunk is able to aggregate all the cloudwatch metric configurations under a single input
alt text

But when we generate inputs.conf with an automation program, appending a generated valid UUID at the end of cloudwatch input names, Splunk creates individual cloudwatch inputs in the UI

Using configuration files, how can we ensure Cloudwatch inputs for a single account are summarised in a single line in the UI, such as when added via UI ?

alt text

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...