Splunk® Supported Add-ons

Splunk Add-on for AWS

Download manual as PDF

Download topic as PDF

Configure Config inputs for the Splunk Add-on for AWS

Configure Config inputs for the Splunk Add-on for AWS.

About configuring inputs

  • Configure SQS-based S3 inputs to collect this type of data.
  • Configure an AWS Config input for the Splunk Add-on for Amazon Web Services on your data collection node through Splunk Web. This data source is only available in a subset of AWS regions, which does not currently include China or GovCloud. See the AWS documentation for a full list of supported regions.
  • Configure a single enabled Config modular input for each unique SQS. Multiple enabled modular inputs can cause conflicts when trying to delete SQS messages or S3 records that another modular input is attempting to access and parse. Be sure to disable or delete testing configs before releasing your configuration in production.


Configure a Config input using Splunk Web

To configure inputs using Splunk Web, click Splunk Add-on for AWS in the left navigation bar on Splunk Web home, then click Create New Input > Config > Config.

Argument in configuration file Field in Splunk Web Description
aws_account AWS Account The AWS account or EC2 IAM role the Splunk platform uses to access your Config data. In Splunk Web, select an account from the drop-down list. In inputs.conf, enter the friendly name of one of the AWS accounts that you configured on the Configuration page or the name of the autodiscovered EC2 IAM role.
aws_region AWS Region The AWS region that contains the log notification SQS queue. In inputs.conf, enter the region ID. See the AWS documentation for more information.
sqs_queue SQS queue name The name of the queue to which AWS sends new Config notifications. In Splunk Web, you can select a queue from the drop-down list if your account permissions allow you to list queues, or enter the queue name manually. The queue name is the final segment of the full queue URL. For example, if your SQS queue URL is http://sqs.us-east-1.amazonaws.com/123456789012/testQueue, then your SQS queue name is testQueue.
sourcetype Source type A source type for the events. Enter a value only if you want to override the default of aws:config. Event extraction relies on the default value of source type. If you change the default value, you must update props.conf as well.

Note that the Splunk platform indexes AWS Config events using three variations of this source type, as follows:

  • Configuration snapshots are indexed as sourcetype=aws:config.
  • Configuration change notifications are indexed as sourcetype=aws:config:notification.
  • Logs from aws_config.log are indexed as sourcetype=aws:config:log.

If you modify the default value of aws:config, you see <yourcustomsourcetype>:notification and <yourcustomsourcetype>:log.

index Index The index name where the Splunk platform puts the Config data. The default is main.
Polling interval Interval The number of seconds to wait before the Splunk platform runs the command again. Default is 30 seconds.

Configure a Config input using configuration file

To configure inputs manually in inputs.conf, create a stanza using the following template and add it to $SPLUNK_HOME/etc/apps/Splunk_TA_aws/local/inputs.conf. If the file or path does not exist, create it.

[aws_config://<name>]
aws_account = <value>
aws_region = <value>
sqs_queue = <value>
interval = <value>
sourcetype = <value>
index = <value>

Some of these settings have default values that can be found in $SPLUNK_HOME/etc/apps/Splunk_TA_aws/default/inputs.conf:

[aws_config]
aws_account =
sourcetype = aws:config
queueSize = 128KB
persistentQueueSize = 24MB
interval = 30 

The values above correspond to the default values in Splunk Web as well as some internal values that are not exposed in Splunk Web for configuration. If you choose to copy this stanza to /local and use it as a starting point to configure your inputs.conf manually, change the stanza title from aws_config to aws_config://<name> and add the additional parameters that you need.

PREVIOUS
Configure inputs for the Splunk Add-on for AWS
  NEXT
Configure Config Rules inputs for the Splunk Add-on for AWS

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Comments

Hi Apreheim,

I recommend that you cross-post your question to Splunk>Answers or the #aws channel in the Splunk-usergroups Slack channel for maximum visibility.

Myu splunk, Splunker
May 23, 2018

Is there a way to assume a role to grab another account's config data like in the other input configurations (description, cloudtrail, cloudwatch, etc.)?

Apreheim
May 18, 2018

Thanks, Tony. The broken links are fixed.

Hunters splunk, Splunker
October 9, 2017

Configure SQS link is broken.

Tonysweet
October 9, 2017

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters