Hello team, As Splunk app for AWS not working or its EOS. Which is the another suitable app for AWS Dashboard in Splunk enterprise?   Reagrds, Nikhil ... View more

hi team, Getting aws : metadata in Splunk Add-on for AWS but not reflecting Splunk App for AWS. I ensured by mentioned things that data is reflecting properly & indexing also. Ensure the metadata is being collected: First, check that the metadata is actually being collected by the Splunk Add-on for AWS. You can do this by searching for the data using the Splunk search language. For example, you can try running a search like this: index=* sourcetype=aws:metadata If you see results from this search, it means that the metadata is being collected and indexed by Splunk. Check that the metadata is being forwarded: If the metadata is being collected by the Splunk Add-on for AWS but not showing up in the Splunk App for AWS, it's possible that it's not being properly forwarded from the indexer to the search head. Check that the data is being forwarded by running the following search: index=* sourcetype=aws:metadata | stats count by sourcetype If you see a non-zero count for aws:metadata, it means that data is being forwarded. Check that the metadata is being indexed: If the metadata is being collected and forwarded, but still not showing up in the Splunk App for AWS, it's possible that it's not being properly indexed. You can check this by running the following search: index=* sourcetype=aws:metadata | table _raw If you see data in the _raw field, it means that the data is being indexed properly. ... View more

hi, I am not getting data of AWS in Splunk for AWS app. Mentioned configuration done. Also splunk_role created with mentioned Policies& attached to splunk instance. Also tried with new splunk user created with admin access & attached same policy, still data not reflecting. policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeReservedInstances", "ec2:DescribeSnapshots", "ec2:DescribeRegions", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DescribeImages", "ec2:DescribeAddresses", "lambda:ListFunctions", "rds:DescribeDBInstances", "cloudfront:ListDistributions", "iam:GetUser", "iam:ListUsers", "iam:GetAccountPasswordPolicy", "iam:ListAccessKeys", "iam:GetAccessKeyLastUsed", "iam:GetPolicyVersion", "iam:ListUserPolicies", "iam:ListAttachedUserPolicies", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeListeners", "s3:ListAllMyBuckets", "s3:GetAccelerateConfiguration", "s3:GetBucketCORS", "s3:GetLifecycleConfiguration", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketTagging" ], "Resource": [ "*" ] } ] }   ... View more

Hello team, I am getting email alert from my gmail ID, I want it from splunk@splunk.abc.com. What need to be done for this?      ... View more

Hi team, I want to set email & slack alert when error code 405 will occur in NGINX access logs. Splunk should trigger when 405 error code will appear. ... View more

Dear team, Unable to access email setting feature while my 60 days also trial not expired. in licensing setting tried to change licence from free license to enterprise license it prompted to install a license. can you please check & suggest for same. ... View more