Issue was with str. Lambda had the following error descriptor 'lower' requires a 'str' object but received a 'unicode': TypeError Traceback (most recent call last): File "/var/task/lambda_function.py", line 213, in handler records = list(processRecords(event['records'],streamARN)) File "/var/task/lambda_function.py", line 113, in processRecords data = ''.join([transformLogEvent(e,data['owner'],arn,data['logGroup'],data['logStream'],data['subscriptionFilters'][0]) for e in data['logEvents']]) File "/var/task/lambda_function.py", line 82, in transformLogEvent if "prod" in str.lower(loggrp): TypeError: descriptor 'lower' requires a 'str' object but received a 'unicode' Changed str.lower(loggrp): to unicode.lower(loggrp) and it is now working and sending to prod or nonprod index depending on cloudwatch log group. ... View more

UPDATE with correct answer [script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] script stanza in \etc\system\local\ DOES NOT capture all WinEventLogs if you did not select all the WinEvent Types during the SplunkUniversalForwarder installation wizard. If you only selected Application event log for example and you want to include System and Security logs to be indexed, update the inputs.conf under \etc\apps\Splunk_TA_windows\local. Just add disabled=0 under the WinEventLog stanzas like below. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 BELOW IS WRONG Spoke with Splunk On-prem Support and confirmed that Splunk Universal Forwarders with the [script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] stanza in the \etc\system\local\inputs.conf will by default push all Windows Event Logs. If you want to limit the Win Event Logs to be indexed, you will have to blacklist the specific logs. https://docs.splunk.com/Documentation/Splunk/6.1.1/Data/Whitelistorblacklistspecificincomingdata http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/MonitorWindowseventlogdata https://www.splunk.com/blog/2014/05/23/controlling-4662-messages-in-the-windows-security-event-log.html https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html ... View more