Description of issue: When a new EC2 instance is created in AWS, Splunk takes an excessive amount of time (upwards of an hour) to recognize the newly created instance and begin collecting data. In addition once Splunk finally recognizes the new EC2 instances, data collection is not consistent and does adhere to the specified interval in the cloud watch settings. One thing to note, a restart of the Splunk service allows data collection to commence. Components: Splunk Cloud, Splunk App for AWS, Splunk Add On for AWS Versions: - Splunk 6.4.1.2 - AWS App 4.2.1 Enabled Data Sources: - Cloud Watch Cloud Watch Input Settings: - EC2 enabled (all other services disabled) - Granularity = 5 minutes - Interval = Granularity x 1 = 5 minutes Questions: 1. Can the frequency in which Splunk queries for newly created/terminated EC2 instances be increased? 2. Are there any known bugs related to Cloud Watch data collection, specifically pertaining to CPU metric ... View more

Where can I configure the frequency in which Splunk will sync newly created EC2 instances? F.Y.I Using the Splunk Add-on for Amazon Web Services. ... View more