Edit your AWS data inputs for Data Manager

Edit your data inputs after onboarding data for AWS accounts. At any given time during the edit, you can only take one kind of action at a time.

1. From the Splunk Cloud menu bar, select Data Manager.
2. From the Data Management page, find the AWS data input you want to revise, and click the Edit action.

Edit your AWS push-based data inputs after single account onboarding

When editing a single account data input, you can change IAM Roles Region and data regions. The account itself cannot be changed or edited.

You can complete the following actions through Data Manager:

• Add one or more new regions, but keep the existing regions as-is.
• Remove one or more existing regions, but don't add new regions.
• Add one or more new custom tags, but keep the existing custom tags as-is.
• Remove one or more existing custom tags, but don't add new custom tags.
• Change IAM Roles Region, but keep the data regions as-is.

For example, you can only add or remove regions as separate actions. You cannot add and remove at the same time.

Edit your pull-based AWS data inputs after single account onboarding

When editing a single account data input, you can only edit the following fields. The account itself cannot be changed or edited.

You can complete the following actions through Data Manager:

• Add or remove SQS Queues
• Add or remove S3 Bucket Patterns
• Add or remove AWS KMS keys
• Change your data destination (Splunk index)
• Change IAM Roles Region

Edit your push-based data inputs after multiple account onboarding

When editing a multiple account data input, you can edit accounts, IAM Roles region, and data regions.

You can complete the following actions through Data Manager

• Add one or more new accounts, but keep the regions as-is.
• Remove one or more existing accounts, but keep the regions as-is.
• Add one or more regions, but keep the data accounts as-is.
• Remove one or more existing regions, but keep the data accounts as-is.
• Add one or more new accounts and add one or more new regions, but don't remove existing accounts or regions.
• Remove one or more existing accounts and remove one or more existing regions, but don't add new accounts or regions.
• Add one or more new custom tags, but keep the existing custom tags as-is.
• Remove one or more existing custom tags, but don't add new custom tags.
• Change IAM Roles Region, but keep the accounts and data regions as-is.
• Change IAM Roles Region to a region that is among the existing data regions.

For example, you can only add or remove regions as separate actions. You cannot add and remove at the same time. The example remains true for accounts as well. You can only add or remove accounts as separate actions. You cannot add and remove at the same time.

You can only change the IAM Roles Region to a region that is among the existing data regions. If you want to set the IAM Roles region to another region, first onboard that region as a data region in a separate action.

Example

Current IAM Roles Region = us-east-1, and data regions = [us-west-1, us-west-2]. If you want to change IAM Roles region to us-east-2, first onboard us-east-2 as data region. Then you will be able to change the IAM Roles Region from us-east-1 to us-east-2.

Input state after action 1 (add data region us-east-2 and perform deployment steps):

• IAM Roles Region = us-east-1
• data regions = [us-west-1, us-west-2, us-east-2]

Input state after action 2 (change IAM Roles region and perform deployment steps):

• IAM Roles Region = us-east-2
• data regions = [us-west-1, us-west-2, us-east-2]

If you no longer need us-east-2 as a data region, you can remove or offboard it as a separate action. Input state after action 3 (remove data region us-east-2 and perform deployment steps):

• IAM Roles Region = us-east-2
• data regions = [us-west-1, us-west-2]