Hi, i try to setup Splunk Add-on for Amazon Web Services (v.1.0.1 on 6.2.0) with little success. it seems that my connection setup access key + secret key are working. From my understanding of the documentation http://docs.splunk.com/Documentation/AddOns/latest/AWS/ConfigureAWS all access rights are setup properly. Still i get a lot of errors in splunk. S3 this seem to be a major thing, when i try to setup S3 input. I can select aws account, select bucket and i get this : In handler 'splunk_ta_aws_s3key': Unexpected error "<class 'boto.exception.S3ResponseError'>" from python handler: "S3ResponseError: 400 Bad Request ". See splunkd.log for more details. splunkd.log throws: 01-08-2015 20:21:04.055 +0100 ERROR AdminManagerExternal - Unexpected error "<class 'boto.exception.S3ResponseError'>" from python handler: "S3ResponseError: 400 Bad Request\n". See splunkd.log for more details. host = splunkvm03 index = _internal source = /opt/splunk/splunk-6.2.1-245427-Linux-x86_64/var/log/splunk/splunkd.log sourcetype = splunkd 08.01.15 20:21:04,055 01-08-2015 20:21:04.055 +0100 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "/opt/splunk/splunk-6.2.1-245427-Linux-x86_64/lib/python2.7/site-packages/splunk/admin.py", line 70, in init\n hand.execute(info)\n File "/opt/splunk/splunk-6.2.1-245427-Linux-x86_64/lib/python2.7/site-packages/splunk/admin.py", line 527, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/opt/splunk/splunk-6.2.1-245427-Linux-x86_64/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws_s3key_handler.py", line 28, in wrapper\n result = func(*args, **kwargs)\n File "/opt/splunk/splunk-6.2.1-245427-Linux-x86_64/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws_s3key_handler.py", line 53, in handleList\n bucket = connection.get_bucket(self.callerArgs['bucket_name'][0])\n File "/opt/splunk/splunk-6.2.1-245427-Linux-x86_64/etc/apps/Splunk_TA_aws/bin/boto/s3/connection.py", line 502, in get_bucket\n return self.head_bucket(bucket_name, headers=headers)\n File "/opt/splunk/splunk-6.2.1-245427-Linux-x86_64/etc/apps/Splunk_TA_aws/bin/boto/s3/connection.py", line 549, in head_bucket\n response.status, response.reason, body)\nS3ResponseError: S3ResponseError: 400 Bad Request\n\n Cloudtrail I can setup everything, select aws account, region, select the sqs queue and so forth. but don't get any data in. in aws_cloudtrail.log i see: 08.01.15 21:19:27,955 2015-01-08 21:19:27,955 INFO pid=27777 tid=MainThread file=aws_cloudtrail.py:<module>:419 | EXITED: 1 host = splunkvm03 index = _internal source = /opt/splunk/splunk-6.2.1-245427-Linux-x86_64/var/log/splunk/aws_cloudtrail.log sourcetype = aws_cloudwatch-2 08.01.15 21:19:27,954 2015-01-08 21:19:27,954 CRITICAL pid=27777 tid=MainThread file=aws_cloudtrail.py:stream_events:286 | Outer catchall: ParseError: no element found: line 1, column 0 host = splunkvm03 index = _internal source = /opt/splunk/splunk-6.2.1-245427-Linux-x86_64/var/log/splunk/aws_cloudtrail.log sourcetype = aws_cloudwatch-2 08.01.15 21:19:27,491 2015-01-08 21:19:27,491 DEBUG pid=27777 tid=MainThread file=aws_cloudtrail.py:stream_events:210 | Connect to S3 & Sqs sucessfully host = splunkvm03 index = _internal source = /opt/splunk/splunk-6.2.1-245427-Linux-x86_64/var/log/splunk/aws_cloudtrail.log sourcetype = aws_cloudwatch-2 08.01.15 21:19:27,448 2015-01-08 21:19:27,448 INFO pid=27777 tid=MainThread file=aws_cloudtrail.py:get_access_key_pwd_real:109 | get account name: test host = splunkvm03 index = _internal source = /opt/splunk/splunk-6.2.1-245427-Linux-x86_64/var/log/splunk/aws_cloudtrail.log sourcetype = aws_cloudwatch-2 08.01.15 21:19:27,448 2015-01-08 21:19:27,448 DEBUG pid=27777 tid=MainThread file=aws_cloudtrail.py:stream_events:196 | blacklist regex for eventNames is ^(?:Describe|List|Get) host = splunkvm03 index = _internal source = /opt/splunk/splunk-6.2.1-245427-Linux-x86_64/var/log/splunk/aws_cloudtrail.log sourcetype = aws_cloudwatch-2 08.01.15 21:19:27,448 2015-01-08 21:19:27,448 DEBUG pid=27777 tid=MainThread file=aws_cloudtrail.py:stream_events:178 | Start streaming. Billing Here i can select aws account, bucket and when i try to save i get the following error thrown. In handler 'aws_billing': Failed AWS Validation: S3ResponseError: 400 Bad Request (None): To me it looks like the s3 does not really work, but i have no idea why. trying to setup up everything manually via inputs.conf didn't bring any success, the errors in splunkd.log seems to be the same. Does some have an idea? did i miss something curial? The Python Errors and AWS Validation messages doesn't make any sense to me. Thanks in advance ... View more