Please can a moderator merge this with https://answers.splunk.com/answers/822015/splunk-enterprise-803splunk-803.html ... View more

The region us-east-1 is used because that is the only region you can get the Trusted Advisor feed from. Could you go to: YourSplunkServer/en-US/app/TA-aws-trusted-advisor/reports and Click "Open in Search" for the report "Trusted Advisor Checks Lookup Populator". This should populate the lookup file. If you then go back to the dashboard, does it load? It would be worthwhile enabling the "Trusted Advisor Checks Lookup Populator" report to run on a schedule to update with the latest Trusted Advisor checks on a regular basis. The report runs | getchecks | outputlookup trusted_advisor_checks Let me know how you get on - I'll try and get the documentation updated ASAP too. ... View more