Splunk Enterprise

Logs not getting ingested from S3 bucket

VijaySrrie
Builder
Hi, We are trying to ingest logs from S3 bucket to splunk, we are not seeing any error at splunk end, but logs are not getting ingested into splunk. Let me know how to proceed further. Thanks, Vijay Sri S
0 Karma
1 Solution

VijaySrrie
Builder

We used below values to fetch the logs

aws_account = 
bucket_name = 
sourcetype = 
index = 
host_name = 
polling_interval =
character_set = 
ct_blacklist = 
aws_iam_role = 
initial_scan_datetime = 
max_items = 
max_retries = 
recursion_depth = 
key_name = 
disabled = 

 (Key name is the folder structure from where we fetch the logs)

Now it is working fine, we had access issues which was addressed, then the key_name provided by app team was wrong that was also address after that it worked fine. 

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust
Much more information is needed. What method are you trying to use to ingest the S3 logs? Do the AWS security settings permit reading of the logs? Are you looking in the right place in Splunk?
---
If this reply helps you, Karma would be appreciated.
0 Karma

VijaySrrie
Builder

We used below values to fetch the logs

aws_account = 
bucket_name = 
sourcetype = 
index = 
host_name = 
polling_interval =
character_set = 
ct_blacklist = 
aws_iam_role = 
initial_scan_datetime = 
max_items = 
max_retries = 
recursion_depth = 
key_name = 
disabled = 

 (Key name is the folder structure from where we fetch the logs)

Now it is working fine, we had access issues which was addressed, then the key_name provided by app team was wrong that was also address after that it worked fine. 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...