Hi Ryan, If the issue is that your CloudTrail data is never reaching your SQS, revisit the CloudTrail configuration in your AWS account. http://docs.splunk.com/Documentation/AWS/latest/Installation/ConfigureyourAWSservices#Configure_CloudTrail Tips: For best results, create a new S3 bucket to store CloudTrail events -- don't use an existing one. Follow the AWS docs so that you can ensure the permissions are correct immediately as you complete that step. http://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html Double check the permissions again to be sure that the account that you use to connect from the app has permission for both the S3 bucket and the SQS. Check with your AWS Admin to verify there are not OTHER policies overriding the account's permissions. Verify that no other script or input is consuming messages from the SQS queue. This other script or message may be another input from the Splunk App for AWS or some other app or software that has permission to read that queue. If none of those troubleshooting steps are effective, you can try ingesting your CloudTrail data using the S3 input instead of the CloudTrail input, bypassing the need for an SQS. Follow the steps here http://docs.splunk.com/Documentation/AWS/latest/Installation/S3 and be sure to set the sourcetype to aws:cloudtrail ... View more

If you are using the conf files for configuration, try adding index = SEP to each stanza. If you are configuring on a node that has a Splunk Web UI, you can select an index on the Input Settings screen as you go through the GUI steps to define each file monitor input. ... View more

Try removing eventgen.conf, all files in the Samples folder, and inputs.conf before you deploy to an indexer cluster. Let us know if that solves the problem. For reference: http://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall#Indexer_clusters Because this gotcha is easy to run into, I'll update the installation instructions for this add-on to call it out. [Answer edited to include inputs.conf among items to delete on indexer clusters.] ... View more

Hi Vamsi92, Check to make sure that the account that you are using to integrate with your ServiceNow instance from the Splunk platform has read-only (at least) permissions to your "task_survey" table. You may need to create an additional access control rule just for this table, as well as for any other custom tables that you want to add. See steps 7 and 8 here for more details: http://docs.splunk.com/Documentation/AddOns/latest/ServiceNow/ConfigureServiceNowtointegratewithSplunkEnterprise Please let us know if that solves the issue! ... View more

Thanks for reporting this, Grahamw81. If you have confirmed that you are getting the data that you expect, that is what matters. I'll report to the dev team that the message should take into account that inputs may be configured directly through the add-on. To clear the message, you can try going to the configuration tab in the Splunk App for AWS, opening your inputs there, and resaving them without (necessarily) making any changes. Try this first with just the Metadata input or the Billing input to see if that changes the message. If that works, you may want to also resave your Config, CloudWatch, and CloudTrail inputs from the app. NOTE, however, that resaving CloudWatch, CloudTrail, and Config inputs from the Splunk App for AWS may cause some of advanced parameters to change when you resave. See http://docs.splunk.com/Documentation/AWS/4.0.0/Installation/Migrationguide#Migrate_your_existing_input_configurations for details of the resaving behavior. You can always change the parameters back from the add-on if this affects you. ... View more

Thanks, guilmxm -- the docs indeed do not match the data model. I'll get that fixed. ... View more

You should install the add-on to your search heads, indexers, and forwarders. The data collection should be done on forwarders rather than on indexers as a best practice. If you happen to use heavy forwarders for your data collection, you do not need to install the add-on to indexers in that case. Here is the add-on documentation's installation instructions: http://docs.splunk.com/Documentation/AddOns/latest/BlueCoatProxySG/Install ... View more

Hi banderson7, thanks for your question. I'll add some more clarification around this in the docs. You don't need this add-on's default/inputs.conf on your search heads because: For inputs that use DB Connect, you should be using the inputs.conf file in the DB Connect app context to handle your inputs. If you do this from the search heads directly, then follow the docs to copy the information you need from our default/inputs.conf file into the DB Connect inputs.conf file. If you are gathering data through DB Connect through a heavy forwarder instead of on search heads, then do all this on that heavy forwarder instead. For inputs that do not use DB Connect, you need to install a universal or light forwarder directly on your MS SQL Server instances. The monitor inputs will run there and forward data on to your indexers. ... View more

The add-ons that you are trying to access may not have any views (dashboards, custom configuration screens, etc) in Splunk Web. If you make an add-on "visible" in Splunk Web, but the add-on doesn't have any views to show, then this can happen. In the screenshot above, it looks like you are trying to get to the Splunk Add-on for Nessus. The Splunk Add-on for Nessus doesn't have any views. You can set up this add-on by going to Apps > Manage Apps and then clicking on Set up in the row for Splunk Add-on for Nessus. You can get to the inputs by going to Settings > Data inputs, then clicking on Splunk Add-on for Nessus. No custom views are required for either action. To turn off visibility for an add-on, go to Apps > Manage Apps, then click on Edit Properties in the row for that add-on. Change Visibility from Yes to No. ... View more