are you using the Cloudwatch Logs input, or just an S3 input? You should be seeing a format like this: sourcetype=aws:cloudwatchlogs:vpcflow 2 000000000000 eni-00000000 43.97.128.12 83.165.209.134 41151 59573 75 2 9730 1450112760 1450112760 ACCEPT OK ... View more

Posted our workaround for this bug here: http://splunk-base.splunk.com/answers/78143/why-is-lsof_sossh-not-returning-any-data ... View more

The documentation was inaccurate. The [crawlers] stanza does not, in fact, exist. We've just corrected the documentation; read it here: http://www.splunk.com/base/Documentation/latest/Admin/Findmorethingstomonitorwithcrawl Also, refer to the crawl.conf spec file here: http://www.splunk.com/base/Documentation/latest/Admin/Crawlconf ... View more