I am attempting to list all of my inputs that I have configured in "Splunk_TA_aws"   I am able to list all of my inputs set up as Cloudtrail, S3,  and SQS. I am unable to see my 20+ (all working) inputs for Cloudwatch logs. I have attempted to hit: https://blahblah:8089/servicesNS/admin/Splunk_TA_aws/data/inputs/aws_cloudwatch_logs/ and https://blahblah:8089/servicesNS/admin/Splunk_TA_aws/data/inputs/aws_cloudwatch/ 0 results show up. As mentioned hitting the other endpoints for Cloudtrail, s3, and SQS are showing correctly. Is there another path/location to gather my inputs set up as Cloudwatch logs? ... View more

Hi, I am currently using the AWS Add-on for Splunk, and am looking to see if I can blacklist based on regex other than the applications UI for blacklisting based on eventnames. (using the blacklist method provided by the app: https://docs.splunk.com/Documentation/AddOns/latest/AWS/CloudTrail)   I have a central Cloudtrail for all of my accounts and looking to send logs from a certain account to nullque so they are not ingested. The logs do have a field for AccountID. Reason being the specific logs from the account are about 80 percent of my ingestion and are not needed. I saw this article but as mentioned before I am not able to modify these files directly due to being on Splunk Cloud: https://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest   Since I do not have access to modify transform.conf or props.conf.  I was told I could modify the applications .conf files and send a zipped folder of the modified contents for Splunk team to upload and install. Currently I do have blacklisting implemented on EventNames as this is part of the application.  Is there any guidance on how I can blacklist based on regex such as accountID=(id for account I want to send to nullque)? ... View more