There are many things depending on this app working correctly, mainly the aws.conf file. However if everything looks right, but you are still getting this error, then perform the following: 1 - There may be a typo in the script - search the script for "spleep" and change to read "sleep" 2 - Update the "boto" python libraries in the SplunkAppforAWS using the following commands (linux): sudo yum install python-pip sudo python-pip install boto --upgrade 3 - Search the get_instances.py script for the line that reads " running_all = ec2_conn.get_all_instances() " 4 - Right above this line, enter the following. " running_all = [] " Now your script should read as follows: running_all = [] running_all = ec2_conn.get_all_instances After all of this, restart splunk and you should be good. ... View more

Hi Olivier, The problem here is that a search will only use a Report Acceleration (RA) summary, if the hash of the accelerated part of the new search is exactly the same as the original acceleration search. EG: index=main sourcetype=my_sourcetype | timechart count by host The entirety of this search above is accelerated and a summary is created from its results. If we create another search as follows, it WILL use the RA summary generated from the above search because the hash of the RA part of the search is the same as the RA search above: index=main sourcetype=my_sourcetype | timechart count by host | search host=my_host Although this search is different to the one that was report accelerated, it will STILL use the summary from the first search because the "RA part" of the search is the EXACT same and thus the hash is the same. Now if we move back to your example... you have included "earliest" and "latest" in the middle of the "RA part" of the search. This changes the hash and thus it will not use the summary from the original RA search. Therefor the following search would NOT use the RA summary from my example because we have changed the hash of the RA part of the search and it does not match the original RA search: index=main earliest=-2d@d latest=now sourcetype=my_sourcetype | timechart count by host | search host=my_host Does that make sense. As a rule of thumb, if you want to use a RA summary from another search, you must ensure that the NEW search has the exact same hash as the original RA search, and then you can pipe on more commands. But make sure that the FIRST part of the new search matches the RA search. Hope that helps. John ... View more