It doesn't appear that these get logged since the bulletin board does not log these into an index, but they are accessible via REST: | rest /services/admin/messages splunk_server=local   More details found here: https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/managebulletins/ ... View more

You can use this search: index=_audit sourcetype=audittrail action=success ... View more

You can do this a couple ways: Through the CLI you can use the Splunk_TA_aws/bin/tools/configure/configure.py script with the following command: /opt/splunk/bin/splunk cmd python aws_config_cli.py iam-role create --config-file input.json --hostname localhost Create your input.json and splunk-info.json files based on the samples found in Splunk_TA_aws/bin/tools/configure/config_examples You can also manually edit the password.conf and splunk_ta_aws_iam_roles.conf files in Splunk_TA_aws/local Here's a passwords.conf example: [credential:__REST_CREDENTIAL__#Splunk_TA_aws#configs/conf-splunk_ta_aws_iam_roles#BaseRestHandler:my-iam-role:] password = Here's a splunk_ta_aws_iam_roles.conf example: [my-iam-role] arn = arn:aws:iam::<aws_account_id>:role/my-iam-role They key is to leave the password entry blank since the "credential" value isn't encrypted. ... View more

Check out the tools found in Splunk_TA_aws/bin/tools/configure. This will provide you with a CLI approach to add IAM roles by using your custom-created JSON files for your configurations. You can run something like the following: /opt/splunk/bin/splunk cmd python aws_config_cli.py iam-role create --config-file description_input.json --hostname localhost This will expect your description_input.json file and a separate splunk-info.json file that contains your authentication information. Unfortunately it doesn't look like you can specify a file/location name for splunk-info.json so it needs to reside in the same directory as the aws_config_cli.py script. ... View more

How can I add in my credentials for the Qualys site without using the GUI? This is the key part of deployment that seems to be missing from the CLI. ... View more

I downvoted this post because this isn't the correct answer for milliseconds as the question asked. The documentation in Splunk documentation for timestamp recognition identifies that you can use either TIME_FORMAT=%s%3N or TIME_FORMAT=%s%Q ... View more