Hi How you have installed your splunk into your AMI and how you have configured it before you have created AMI from that EC2 node? I suppose that you haven't clear GUID for that instance before you created it as AMI? Here is instructions how to do it for Windows UF clients https://docs.splunk.com/Documentation/Splunk/latest/Admin/Integrateauniversalforwarderontoasystemimage Unfortunately I'm afraid that this is not working on Linux? But you could try to the next Clean event data splunk stop splunk clean eventdata remove $SPLUNK_HOME/etc/instance.cfg remove current hostname etc. from $SPLUNK_HOME/etc/system/local/*.conf files Probably something else is also needed and if you have anything specific you should add/remove those based on your needs. Anther option (even better) is use as standard AMI without splunk part and have some automation which installs needed splunk UF version and needed configurations always when you launch a new EC2 node.  r. Ismo