You might have resolved your issue since it's been a while. Anyway, here is the steps that I think to setup the billing and usage configuration.
In your main account, enable AWS programmatic detailed billing service. It delivers CSV files to a bucket in your account
Create an IAM user in the main account to give it "Read Only" access to the S3 billing bucket. Assign key and key secret. Do not use your main account's key and key secret for this.
In aws.conf configuration, config [keys] and [misc] section with the main account's IAM user's key, key secret (e.g. the IAM user that has access to the billing S3 bucket), main account's name and account's number, and main account's S3 bucket.
Restart splunk service.
I have documented some details here.
... View more