You might be getting blocked by AWS security groups.  Try creating a security group allowing outbound to that address and port.  Don't forget to assign it to the instance where it is running. Once that is in place, try making an outbound connection from the instance running docker (but not inside docker itself). openssl s_client -connect smtp.gmail.com:587 If successful, you will see a connection and a certificate sent back.  Then, at least, you'll know you can connect from the instance itself. ... View more

Saved my day. This works perfectly. Thank you so much!! ... View more

Thanks, replace worked. The mentioned syntax didn't work exactly, but it worked in this format: eval category = replace(category, "A_1", "A-1") .Thanks so much, you saved the day!! ... View more

Hey niddhi, Refer this link: https://docs.splunk.com/Documentation/Splunk/7.2.6/Forwarding/Routeandfilterdatad You need to add the filters in props and transforms. You need to add the parameters in the sourcetype stanza(sourcetype = aws:cloudwatch) in the props and transforms. Create this stanza in /opt/splunk/etc/apps/aws/local and not in default. Thou, you will have to verify the path as i am not sure how the app name will reflect. Let me know if this helps!! ... View more

I have exactly the same scenario and its not working. I don't want to add the ip's manually as src, that will defeat the purpose of having a dynamic lookup. Any pointers are appreciated. ... View more

I have a similar case, where i want to filer the incoming data from cloudwatch logs. I am trying to configure props.conf and transform.conf. What should be the value of source in this case? ... View more

I also have the same settings in transform.conf, but its not matching the results. What am i missing here? Any pointers are appreciated. Thanks, ... View more

Late to the show here, but I had the same issue. Found I had spaces at the end of my cidr_range values. If you copy/paste, make sure there are no leading/trailing spaces. ... View more