Splunk® App for AWS (Legacy)

Installation and Configuration Manual

On July 15, 2022, the Splunk App for AWS will reach its end of life (EOL). After this date, Splunk will no longer maintain or develop this product. Splunk App for AWS is used for both IT monitoring and security use cases because it provides dashboards for both ITOps and security teams. The IT monitoring functionality in Splunk App for AWS is migrating to a content pack in Data Integrations called the Content Pack for Amazon Web Services Dashboards and Reports. The security use case functionality in Splunk App for AWS is migrating to the new Splunk App for AWS Security Dashboards. For more about migration options, see this community post.
This documentation does not apply to the most recent version of Splunk® App for AWS (Legacy). For documentation on the most recent version, go to the latest release.

Add a Metadata input for the Splunk App for AWS

The Metadata input gathers metadata about your AWS environment to display in the app dashboards. The Splunk App for AWS creates a Metadata input automatically for each new account that you configure. You can also create them manually. If you are upgrading from a previous version of the Splunk App for AWS and already had accounts configured, create a Metadata input for each account manually.

Prerequisites

Make sure that the account friendly name you use to configure this input corresponds to an AWS Account Access Key ID or EC2 IAM role that has the necessary permissions to gather this data. If you have not already done this, see Configure your AWS permissions for the Splunk App for AWS in this manual.

Manually add a new Metadata input

1. In the app, click Configure in the app navigation bar.

2. Under Data Sources, in the Metadata box, click New input.

3. Select the friendly name of the AWS Account for which you want to configure a Metadata input manually.

4. Under Services, review the list of services for which this input will collect metadata. This list is automatically populated based on the services available to the account you selected.

5. (Optional) If you want to prevent the app from collecting metadata for any of these services, uncheck the relevant boxes.

6. (Recommended) Configure a custom Index for this data.

7. (Optional) Open the Advanced Settings to configure a custom Interval for this data.

8. Click Add to save and enable this data input.

Once saved, the input begins collecting data immediately and checks for updates every 60 minutes, unless you changed the interval.

Edit or delete a Metadata input

You can view, edit, or delete your existing Metadata inputs from the Metadata Inputs screen.

Note: When you delete an account, the Metadata input associated with it is automatically deleted. You do not need to manually delete it before you can delete the account from the app.

1. In the app, click Configure in the app navigation bar.

2. Under Data Sources, in the Metadata box, click the link that tells you how many inputs you currently have configured for Metadata.

3. The Metadata Inputs screen displays a list of Metadata inputs, organized by the name auto-assigned to the input.

4. From here, you can click the names to open the individual inputs to edit them, or delete an input.

Last modified on 13 May, 2016
Add an S3 input for the Splunk App for AWS   Troubleshoot the Splunk App for AWS

This documentation applies to the following versions of Splunk® App for AWS (Legacy): 4.2.0, 4.2.1, 5.0.0, 5.0.1, 5.0.2


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters