Turns out http://docs.splunk.com/Documentation/UnixAddOn/5.2.4/User/Platformandhardwarerequirements is lying. If you install Splunk_TA_nix on forwarders, you must also install it on the server(s) that have installed splunk_app_for_nix. If, and only if, your server (the Splunk instance where splunk_app_for_nix is installed) is to be monitored in exactly the same way as the clients (the machines where a Universal Forwarder and Splunk_TA_nix are installed), then you can install splunk_app_for_nix and Splunk_TA_nix on the server and then deploy that to the clients. Be aware that despite having data inputs (scripts and monitored files and directories) listed separately in the Settings: (Data) Data inputs screen, you will NOT be able to change any setting (such as enabling/disabling) on one without having it change on the other. If you want the server to merely run splunk_app_for_nix and receive Splunk_TA_nix data from forwarders, you must install splunk_app_for_nix AND Splunk_TA_nix on the server (leave Splunk_TA_nix's scripts and monitors disabled, their default setting), and then install Splunk_TA_nix on the forwarders (the clients). You will need to connect to each client and locally run Splunk_TA_nix/bin/setup.sh to enable the scripts and monitors. One key difference with this setup is that the forwarder data inputs will NOT show on the Settings: (Data) Data inputs screen. Note that if you don't intend to change the settings often if at all, you can edit splunk-add-on-for-unix-and-linux_524.tgz to change the "disabled=1" lines in Splunk_TA_nix/default/inputs.conf before deploying the .tgz on the clients. This will save you from having to run setup.h. ... View more

I'm having a very similar issue. I see the billing csv file. My S3 bucket is all lower case. My S3 bucket matches what I've put in local/aws.conf. When I run get_bill.py, I receive the following error: Traceback (most recent call last): File "./get_bill.py", line 4, in ? import os, sys, boto.ec2, calendar, datetime,time, ConfigParser, boto, csv File "/opt/splunk/etc/apps/SplunkAppforAWS/bin/boto/init.py", line 28, in ? from boto.storage_uri import BucketStorageUri, FileStorageUri File "/opt/splunk/etc/apps/SplunkAppforAWS/bin/boto/storage_uri.py", line 27, in ? from boto.s3.deletemarker import DeleteMarker File "/opt/splunk/etc/apps/SplunkAppforAWS/bin/boto/s3/init.py", line 52 from .connection import S3Connection ^ SyntaxError: invalid syntax When I look at /opt/splunk/etc/apps/SplunkAppforAWS/bin/boto/s3/init.py line 52: *def regions(): """ Get all available regions for the Amazon S3 service. :rtype: list :return: A list of :class:`boto.regioninfo.RegionInfo` """ from .connection import S3Connection return [S3RegionInfo(name='us-east-1', endpoint='s3.amazonaws.com', connection_cls=S3Connection),* Is there a typo at the ".connection" line? Changing the line to: from connection import S3Connection* Resolves the error. But, then there's a further error with boto ec2: Traceback (most recent call last): File "./get_bill.py", line 4, in ? import os, sys, boto.ec2, calendar, datetime,time, ConfigParser, boto, csv File "/opt/splunk/etc/apps/SplunkAppforAWS/bin/boto/ec2/init.py", line 26, in ? from boto.ec2.connection import EC2Connection File "/opt/splunk/etc/apps/SplunkAppforAWS/bin/boto/ec2/connection.py", line 3452 'true' if enable_dns_support else 'false') ^ SyntaxError: invalid syntax Maybe the Splunk App for AWS needs an update to the version of boto packaged with it? Downloading the latest boto and replacing the one installed with the app resolved this issue. ... View more

I am having trouble in configuring the AWS Cloudtrail overview in the splunk app for AWS. Not all dashboards are being populated. I am unable to see Network Configuration actions & Start/stop instances. I have tried all solutions mentioned above. Thanks in advance ... View more

Yes, it's resolved now. I was also able to figure out a more limiting ACL for the access keys rather than the Power User policy. You can limit access to just the queue created in SQS as follows: { "Version": "2012-10-17", "Statement":[{ "Effect":"Allow", "Action":"sqs:*", "Resource":"arn:aws:sqs:us-east-1: : " } ] } ... View more

Hi..I am a bit confused still. Is the purpose of the [keys] stanza to list your Master Billing Account access details AND your linked account access details? i.e. [keys] master_account_no = name access_key secret_key limit 01linked_account_no = name access_key secret_key limit 02linked_account_no = name access_key secret_key limit 03linked_account_no = name access_key secret_key limit [misc] corpkey = name access_key secret_key acno = master_account_no s3bucket = bucket_name Is this how it should look like? ... View more