My Splunk Instance is not ingesting or parsing my AWS Config files

[DennisCz42]

I recently started up my Splunk instance in AWS and I have all the necessary apps installed on it to monitor my AWS environment. In the Splunk Add-On for AWS I set up my Config input and for some reason Splunk is failing to ingest my config files from my S3 bucket. Does anyone have any suggestions on how to fix this?

Thanks

[richgalloway]

Please describe in more detail how you've installed Splunk on AWS. In general, Splunk expects to find config files in certain places and S3 is not one of those places.

[DennisCz42]

Hi Rich,

So I basically have one EC2 instance with the Splunk AMI installed on it. This instance is acting like the indexer and search head. For the Splunk Add-on for AWS I configured the Config input with the SQS-based S3 input. Here is a screenshot of the error I am getting from splunk. I see in the search/detail summary section that my config files appear to be ingested but I am not seeing the config data in the Splunk App for AWS and I am seeing health check errors.