Splunk Enterprise

Logs not getting ingested from S3 bucket

vijaysri
Contributor
Hi, We are trying to ingest logs from S3 bucket to splunk, we are not seeing any error at splunk end, but logs are not getting ingested into splunk. Let me know how to proceed further. Thanks, Vijay Sri S
0 Karma
1 Solution

vijaysri
Contributor

We used below values to fetch the logs

aws_account = 
bucket_name = 
sourcetype = 
index = 
host_name = 
polling_interval =
character_set = 
ct_blacklist = 
aws_iam_role = 
initial_scan_datetime = 
max_items = 
max_retries = 
recursion_depth = 
key_name = 
disabled = 

 (Key name is the folder structure from where we fetch the logs)

Now it is working fine, we had access issues which was addressed, then the key_name provided by app team was wrong that was also address after that it worked fine. 

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust
Much more information is needed. What method are you trying to use to ingest the S3 logs? Do the AWS security settings permit reading of the logs? Are you looking in the right place in Splunk?
---
If this reply helps you, an upvote would be appreciated.
0 Karma

vijaysri
Contributor

We used below values to fetch the logs

aws_account = 
bucket_name = 
sourcetype = 
index = 
host_name = 
polling_interval =
character_set = 
ct_blacklist = 
aws_iam_role = 
initial_scan_datetime = 
max_items = 
max_retries = 
recursion_depth = 
key_name = 
disabled = 

 (Key name is the folder structure from where we fetch the logs)

Now it is working fine, we had access issues which was addressed, then the key_name provided by app team was wrong that was also address after that it worked fine. 

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!