Splunk Search

awsAddOn sourcetype=aws:config:notification configurationItem.resourceType = AWS::S3::Bucket no Longer Showing

mcweens
Explorer

Hello, we use the AWS AddOn for Splunk for all of our AWS Inputs.

For a few months, after many years of this showing correctly, we no longer see data under this search:

sourcetype=aws:config:notification configurationItem.resourceType = AWS::S3::Bucket

The thing is, nothing changed other than updates to the AWS AddOn.  AND we still get data under here for every resourceType that I can think of EXCEPT S3, so the AWS side configuration and the inputs I have to assume are set fine.

sourcetype=aws:config:notification

 

I have looked over this in every facet I can think possible and have had a support case open for a while now.  Any thoughts or similar cases?  Thanks!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...