Has anyone experienced continuous automatic refreshing of Splunk (web console) dashboard or apps including searching. When I visit Splunk console and try to navigate to any app or dashboard or even management console. It keeps refreshing every 2/3 seconds. I started noticing this behavior suddenly. I tried following Restart Splunk Restart VM Verify CPU/Disk/Network usage, all seems within acceptable range in fact way under control Splunk deployment Single Node on big vertically scaled instance (32GB RAM, 8vCPU cores) Splunk v7.0.4 on linux x64 Apps Splunk App for AWS, AWS add on Daily ingestion ~35GB Browser - Chrome ... View more

I am using Splunk App for AWS 5.1.1, Splunk Add on for AWS 4.5.0, Splunk Enterprise 7.0.4 hosted in AWS environment I had few questions here 1) Firstly just to confirm 'Metadata input for the Splunk App for AWS'' is same thing as 'Description inputs for the Splunk Add-on for AWS'. Basically, it going to do Get*/Describe*,List* on following resources ec2_volumes, ec2_instances, ec2_reserved_instances, ebs_snapshots, elastic_load_balancers, vpcs, vpc_network_acls, cloudfront_distributions, vpc_subnets, rds_instances, ec2_key_pairs, ec2_security_groups, s3_buckets . This information is used by Splunk App for AWS to provide more insights Is my understanding correct? 2) I have Splunk installed in separate AWS account. This is EC2 role based. I want to get 'Description (Metadata) inputs' from 100's of other AWS accounts I have. To configure this scenario, I have to add role in each account with policy as described here. This role will be assumed by Splunk instance to collect data. Now, on Splunk side, in Splunk Add on for AWS, I have to add this IAM role. As per Splunk documentation under 'Manage IAM roles' Under the Configuration menu, you manage AWS IAM roles that can be assumed by IAM accounts for the Splunk Add-on for AWS to access the following AWS resources: Description, CloudWatch, Kinesis etc Note: Configuring roles by directly editing splunk_ta_aws_iam_roles.conf is not supported. Use the add-on's Configuration menu in Splunk Web to manage IAM roles. You cannot edit or delete EC2 IAM roles from the add-on. So how can I add role information of 100's of AWS accounts that I wish Splunk Add on to get 'Description Inputs' from? Manually adding this through Spunk Web won't be scalable process. Is anyone in similar scenarion? Any advice to share here? ... View more