Currently, the AWS TA Description input supports some APIs described in the AddOn documentation. https://docs.splunk.com/Documentation/AddOns/latest/AWS/DescriptionInput ec2_volumes/3600,ec2_instances/3600,ec2_reserved_instances/3600,ebs_snapshots/3600,elastic_load_balancers/3600,vpcs/3600,vpc_network_acls/3600,cloudfront_distributions/3600,vpc_subnets/3600,rds_instances/3600,ec2_key_pairs/3600,ec2_security_groups/3600 For a lot of people it's interesting to get a listing of the Route53 Record sets created under Hosting Zones. Is there any plan to include support for querying Route53 API and including results under the aws:description sourcetype ? @jzhong_splunk ... View more

When adding Cloudwatch inputs for Splunk Add-on for Amazon Web Services using the UI, it appears that in the background, Splunk appends a UUID to the input definition created in inputs.conf under /splunk/etc/apps/Splunk_TA_aws/local Example: [aws_cloudwatch://account_455e6345-ea85-4303-ad60-00f544bf502a] metric_namespace = AWS/Lambda [...] [aws_cloudwatch://account_455e6023-ba56-4303-ad60-00f544bf502a] metric_namespace = AWS/ApplicationELB [...] For Cloudwatch inputs added via Splunk Web, Splunk is able to aggregate all the cloudwatch metric configurations under a single input But when we generate inputs.conf with an automation program, appending a generated valid UUID at the end of cloudwatch input names, Splunk creates individual cloudwatch inputs in the UI Using configuration files, how can we ensure Cloudwatch inputs for a single account are summarised in a single line in the UI, such as when added via UI ? ... View more