Just as a best practice, all app developers even if it's a custom app for you it's best practice to run your app through app inspect and if for cloud add the cloud tag. If your app is for Splunk Cloud it will still need to go through app vetting via an internal tool. Self service will do this for you but if you need to open a support case to have the app installed it will still be ran through an app cert process. If your app passes app inspect cleanly, no warnings/errors or manual checks, with the cloud tag there is a very good chance it will auto pass the app cert process. If there are warnings or manual checks these will still have to be done by an internal team. If there are errors it will fail at the first error found, if there are more than one error then it will fail each time until they are all corrected. ... View more

The app, https://splunkbase.splunk.com/app/1876/ Splunk_TA_aws, is an assisted install app. If you view the app in the UI you should see that the button states that a support case needs to be opened to install it on the search head. That said, Inputs are not allowed on the search heads in cloud, you need to either use a HWF to bring the data in or have an IDM in your cloud deployment. If you don't have an IDM you will soon be able to reach out to your account team and request one. Uploading a package to be installed is for uploading custom customer managed and created apps. ... View more

It looks like this issue should be fixed in the next release version, the fix is here: https://github.com/Cisco-AMP/amp4e_splunk_events_input/issues/1 ... View more