Appreciate your help, thank you! ... View more

I did not have any inputs in AWS add-on, so I added one via web ui (I was greeted via: "Configuring this add-on on a search head is not best practice." warning), following the instructions in the link you provided. Most everything was pre-selected, I picked aws region, iam-role etc, left the "index" value at "default". When I execute search, I get the results without aws tags.owner. I am able to execute below search from splunk search app and get the info including tags etc. index="" sourcetype="aws:description" source=":ec2_instances" earliest=-5m I guess, issue I have is joining the two searches from two different sources? Thank you ... View more

Hi, Thank you for your answer. I just ran a test search. I can't seem to access sourcetype="aws:description". Only sourcetype available in search results is of "syslog". ... View more