It doesn't appear that these get logged since the bulletin board does not log these into an index, but they are accessible via REST: | rest /services/admin/messages splunk_server=local   More details found here: https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/managebulletins/ ... View more

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that ... View more

Use following in search for Splunk App for AWS index=your_aws_index sourcetype="aws:addon:account" | dedup host, account_id, name | fields - _time |dedup account_id| table name, account_id | outputlookup all_account_ids This should help. ... View more

If it is a script then you can run it by searching a file from /etc/app/appname/andlookfilesshellscript There might be a script which you need to trigger in order to process configuration. You have to search for that shell script ... View more

@mcluver any chance you have the update URL on where this documentation moved to? I am currently working on automating adding our accounts into the AWS addon as well as keeping the accounts up to date and having some trouble. I think this info would help. Thanks! ... View more

You can do this a couple ways: Through the CLI you can use the Splunk_TA_aws/bin/tools/configure/configure.py script with the following command: /opt/splunk/bin/splunk cmd python aws_config_cli.py iam-role create --config-file input.json --hostname localhost Create your input.json and splunk-info.json files based on the samples found in Splunk_TA_aws/bin/tools/configure/config_examples You can also manually edit the password.conf and splunk_ta_aws_iam_roles.conf files in Splunk_TA_aws/local Here's a passwords.conf example: [credential:__REST_CREDENTIAL__#Splunk_TA_aws#configs/conf-splunk_ta_aws_iam_roles#BaseRestHandler:my-iam-role:] password = Here's a splunk_ta_aws_iam_roles.conf example: [my-iam-role] arn = arn:aws:iam::<aws_account_id>:role/my-iam-role They key is to leave the password entry blank since the "credential" value isn't encrypted. ... View more