The simplest way would likely be to create three instances of the app (rename each directory and the contents of default/the app.conf ) and configure your three different accounts that way. ... View more

Have you looked in your internal logs for any messages from the app while it is doing the cloudwatch pull? They are quite informative. ... View more

Any messages in the splunkd.log file on the universal forwarder? It would be in Splunk_home\var\log\splunk\splunkd.log ... View more

You can actually reference the license usage logs for this: index=_internal source=*license_usage.log type=Usage earliest=-1d@d latest=-0d@d | stats sum(b) by st, idx | rename sum(b) as Bytes | eval Volume=round(Bytes/1024/1024, 2) | eventstats sum(Volume) as Total_Volume | fields - Bytes | fieldformat Volume = tostring(Volume, "commas") +"MB" | fieldformat Total_Volume = tostring(Total_Volume, "commas") +"MB" | rename st as Sourcetype, idx as Index ... View more

I believe your problem is that in order for the ES SH to be able to trigger the stream capture, it has to be the SH running the stream app that the forwarders are communicating with. At least, that is the impression I get from http://docs.splunk.com/Documentation/ES/4.7.4/Install/IntegrateSplunkStream ... View more