Splunk_TA_aws/bin/splunk_ta_aws/common/aws_accesskeys.py has been updated to account for IDMSv2 as of Splunk Add-on for AWS 6.0.0. Look for fixed issue ADDON-47661 in the release notes: https://docs.splunk.com/Documentation/AddOns/released/AWS/Releasenotes.   I'm also going to mention a separate issue related to IMDSv2 that you might encounter if running SmartStore and relying on the EC2 instance profile to authenticate your S3 access. There is a setting in server.conf that you will need to enable on your indexers to allow IMDSv2 calls: [imds] imds_version = v2   ... View more

We have not. I'll get that and updating the Windows Server 2012 forwarders to 7.3.5 onto our patching schedule to see if either resolves the issue. Given that will not be a swift process due to some bureaucracy, would it be best to mark this question as resolved with removing the environmental variable as a work around solution? ... View more

Sorry for the delay, I wanted to run the updated configuration for long enough to validate the change. Updating the input from "MonitorNoHandle://$WINDIR\System32\Dns\dns.log" to "MonitorNoHandle://C:\Windows\System32\Dns\dns.log" does indeed resolve the issue. What's really odd though is the $WINDIR variable seems to be working in other inputs. For example, "monitor://$WINDIR\WindowsUpdate.log" being enabled does not generate the error. My guess is that the issue is something specific to the resolution of environment variables by the MonitorNoHandle process. While all of our systems do have C: for the OS drive, it would be more ideal to use the environment variable to protect against edge cases. Is there any thing else we can do to troubleshoot further, or is it time for a bug report? ... View more