I'm trying to configure a cloudwatch logs input but I continue to receive invalid key errors when restarting Splunk on the HF. I've gone by the doc as well as opened a support case but haven't had success. The samples that I've seen and the keys that the support guy were telling me to try are all different than the documentation. I'm starting to think this input type is just bugged and doesn't work at all. Has anyone been able to configure this type of input? And if so, do you mind sharing what you did?   Errors   Invalid key in stanza [aws_cloudwatch_logs://REDACTED] in /opt/splunk/etc/apps/Splunk_TA_aws/local/inputs.conf, line 34: account (value: REDACTED). Invalid key in stanza [aws_cloudwatch_logs://REDACTED] in /opt/splunk/etc/apps/Splunk_TA_aws/local/inputs.conf, line 35: groups (value: /blah/blah/redacted, /blah/more/redacted). Invalid key in stanza [aws_cloudwatch_logs://REDACTED] in /opt/splunk/etc/apps/Splunk_TA_aws/local/inputs.conf, line 38: region (value: us-east-1).     Details Splunk Enterprise 8.1.4 AWS add-on 5.0.3 Installed on Amazon Linux Doc:  https://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatchLogs My current stanza   [aws_cloudwatch_logs://REDACTED] account = REDACTED groups = /blah/blah/redacted, /blah/more/redacted index = staging sourcetype = aws:cloudwatchlogs:log interval = 1800 region = us-east-1 disabled = 0       ... View more

Disclaimer: This is an issue with VMware and not Splunk. But looking to see if others in the community have seen the same issue. Our infrastructure team has recently upgraded VMware to v7. We immediately started receiving an additional terabyte of logs from their hosts. They have a support case open with the vendor to figure out why, and the vendor agrees that this is not normal and we shouldn't have seen this volume spike. They're leaning more towards a misconfiguration than a bug. They're also wondering if others in the community have seen the same from VMware v7, and if so how was it handled. Has anyone who is using v7 of VMware seen the logging spike? If so, how did you resolve it?  ... View more

I need help creating an alert action to run a simple bash script.  I created a custom app with a local/alert_actions.conf file. I have the script in the /opt/splunk/bin/scripts/ directory, but its not being called. I've tried the full path as well as the filename and I'm seeing the following errors both ways. I can run the script manually from the cli and it works fine. I'm wondering what I'm missing?      [test_custom_alert_action] is_custom = 1 label = testing the custom alert action description = Send splunk event data to a script #alert.execute.cmd = /opt/splunk/bin/scripts/test-script-action.sh alert.execute.cmd = test-script-action.sh     Errors     06-15-2021 16:33:11.603 -0500 ERROR sendmodalert - action=test_custom_alert_action - Failed to find alert.execute.cmd "test-script-action.sh". and 06-15-2021 16:30:12.352 -0500 ERROR sendmodalert - action=test_custom_alert_action - Failed to find alert.execute.cmd "/opt/splunk/bin/scripts/test-script-action.sh".       I'll also need to add arguments to send results to the script. I know I'll need to use alert.execute.cmd.arg.0 but I figured I'd just get the script working first.  ... View more