I have a real time alert happily setup that looks for a specific condition in an index. This alert triggers if said condition is met 5 times in 20 minutes.... its a rolling 20 minute window. On alert , Splunk generates some notification emails and restarts windows services on a remote server. All ok so far..... My need is to stop this alert "looking" for the condition during the backup window... say daily 2100 to 0100. Problem is the nature of the backup process induces the alert condition many times. Can anyone help or advise on how to stop or pause this alert at the required time... for the required period? ... View more

I see a mountain of these in the errors.txt file. 01-14-2014 16:37:38 E. Australia Standard Time xxxxxxxxxxxx ap-southeast-2 --ops-3-- Can get no indication on where or at what stage this app fails. What do they mean? Is it possible to get some meaningful logs so we can get this thing working? ... View more

Was wondering if someone out there can offer up some help or assistance. Can't get billing working no matter what I try. Some EBS volume and snapshot data retrieved ok but no bills/usage data. All I get is "No result found" I have also created an IAM user with specific permissions under the master account without luck. I have enabled IAM access to Billing info in AWS account settings The aws.conf file looks like this.... and I have added some notes: all this three stanzas are required, in order to run AWS App. [keys] At least one entry required for this stanza 111111111111 = MasterCompany XXXXXXXXXXX YYYYYYYYYYYYYYYYYYYY ---- This access key/secret crated when logged in as Master Account in the “Your Security Credentials” section All the below sub accounts appear in the master company consolidated billing section and are linked and I have logged into each sub account individually to create their own access keys and secrets. 222222222222 = SubAccount_A AAAAAAAAAAAA BBBBBBBBBBBBBBBBBB 333333333333 = SubAccount_B BBBBBBBBBBBBB CCCCCCCCCCCCCCCCC 444444444444 = SubAccount_C CCCCCCCCCCCCC DDDDDDDDDDDDDDDDD 555555555555 = SubAccount_D DDDDDDDDDDD EEEEEEEEEEEEEEEEEEEE [regions] At least one entry required for this stanza rgn8 = ap-southeast-2 -- my region [misc] corpkey = MasterCompany XXXXXXXXXXX YYYYYYYYYYYYYYYYYYYY ---same as above in keys section acno is corp account number for AWS acno = 111111111111 - this appears in the billing csv as the [PayerAccountId] s3bucket is bucket name where AWS bill csv files will be dropped s3bucket = splunkapi_bucket --- reports appear here correctly with sub accounts (combined billing with correct [LinkedAccountId] that match the above sub accounts ) ... Master Company user can manually view and download files. In the Splunk for AWS apps log dir I see correct info for my instance type etc. in the c1.txt file errors1.txt = no entries errors.txt = no current entry although full of info from all my previous attempts. but mainly has these lines.. 01-09-2014 09:19:28 E. Australia Standard Time 111111111111 ap-southeast-2 --ops-3-- Really stuck here and am obviously missing something. ... View more