Skip to content

Release history for the Splunk Add-on for AWS

Latest release

The latest version of the Splunk Add-on for Amazon Web Services is version 7.7.1. See Release notes for the Splunk Add-on for AWS for the release notes of this latest version.

Version 7.7.0

Compatibility

Version 7.7.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 9.1.x, 9.2.x, 9.3.x
CIM 5.1.1 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, EventBridge (CloudWatch API), Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Transit Gateway Flow Logs, Billing Cost and Usage Report, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, AWS Security Hub findings, and Amazon Security Lake events

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 7.7.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Provided support for metric index in the VPC Flow Logs input.
    • The fields bytes and packets are considered as metric measures and rest of the fields as dimensions.
    • The events having log_status field as NODATA or SKIPDATA will not be ingested in the metric index as they don’t contain any values for metric measures.
  • Enhanced the time window calculation mechanism for CloudWatch Logs input data collection. Added Query Window Size parameter in the UI. For more information, see CloudWatch Log inputs.
  • Fixed the data miss issue in the Generic S3 input.
  • Provided compatibility for IPv6.
  • Security fixes.

Fixed issues

Version 7.7.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 7.7.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 7.7.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 7.6.0

Compatibility

Version 7.6.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.2.x, 9.0.x, 9.1.x, 9.2.x
CIM 5.1.1 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, EventBridge (CloudWatch API), Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Transit Gateway Flow Logs, Billing Cost and Usage Report, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, AWS Security Hub findings, and Amazon Security Lake events

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 7.6.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Security Lake input now supports OCSF schema v1.1 for AWS log sources Version 2. For more information, see the OCSF source identification section of the Open Cybersecurity Schema Framework (OCSF) topic in the AWS documentation.
  • Deprecated Billing (Legacy) input. Configure Billing (Cost and Usage Report) input to collect billing data. For more information, see Cost and Usage Report inputs.
  • Provided support of Transit Gateway Flow Logs.
    • The default format of logs in text file format is supported.
    • SQS-based-S3 input type is supported in the pull-based mechanim.
    • Transit Gateway Flow Logs can also be collected through push-based mechanism.
  • Enhanced the input execution of CloudWatch input to improve the performance. Added CloudWatch Max Threads parameter in Configuration > Add-on Global Settings page. For more information, see Add-on Global Settings.
  • CIM fields protocol, transport, and protocol_full_name updated as per CIM best practices. This change will impact below-mentioned sourcetypes:
    • aws:cloudwatchlogs:vpcflow
    • aws:cloudtrail
    • aws:transitgateway:flowlogs
  • Security fixes.
  • Minor bug fixes.

Fixed issues

Version 7.6.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 7.6.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 7.6.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 7.5.1

Compatibility

Version 7.5.1 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.2.x, 9.0.x, 9.1.x
CIM 5.1.1 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, EventBridge (CloudWatch API), Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, AWS Security Hub findings, and Amazon Security Lake events

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 7.5.1 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Provided support for Python 3.9.
  • Minor UI Improvements for a more streamlined upgrade experience.

Fixed issues

Version 7.5.1 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 7.5.1 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 7.5.1 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 7.5.0

Version 7.5.0 of the Splunk Add-on for Amazon Web Services was released on April 2, 2024.

Compatibility

Version 7.5.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.2.x, 9.0.x, 9.1.x
CIM 5.1.1 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, EventBridge (CloudWatch API), Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, AWS Security Hub findings, and Amazon Security Lake events

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 7.5.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Provided support of Cloudtrail Lake Input.
  • Provided support of Assume role in Cloudwatch Logs Input.

  • Enhanced the CIM support for aws:cloudwatch:guardduty and aws:cloudwatchlogs:guardduty sourcetypes.

    • The CIM field mitre_technique_id was removed in this release because:
      1. The existing values were found inaccurate and misleading.
      2. The vendor does not provide the mitre technique IDs in the GuardDuty events.
    • The fields src_type and dest_type were corrected or added for all the GuardDuty events.
    • The transport field got corrected for a few events.
    • The signature and signature_id field got corrected for the GuardDuty events.
    • The src field was added or corrected for certain events.

    • See the following table to review the data model information based on the service.actionType field in your GuardDuty events.

      Alerts Data Model Intrusion Detection Data Model
      AWS_API_CALL, KUBERNETES_API_CALL, RDS_LOGIN_ATTEMPT OR service.actionType is null. NETWORK_CONNECTION, DNS_REQUEST, PORT_PROBE

  • Enhanced data collection for Metadata Input. Previously, if input is configured with multiple regions then input was collecting the global services data from every configured region which was causing the data duplication in the single input execution. In this version, this data duplication for global services is removed by collecting data from any one region if multiple regions are configured in the same input.

  • Minor bug fixes.

Fixed issues

Version 7.5.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 7.5.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 7.5.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 7.4.1

Version 7.4.1 of the Splunk Add-on for Amazon Web Services was released on February 21, 2024.

Starting in version 7.1.0 of the Splunk Add-on for AWS, the file based checkpoint mechanism was migrated to the Splunk KV Store for Billing Cost and Usage Report, CloudWatch Metrics, and Incremental S3 inputs. The inputs must be disabled whenever the Splunk software is restarted. Otherwise, it will result in data duplication against your already configured inputs.

Version 7.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into your Splunk platform deployment.

If you use both the Splunk Add-on for Amazon Security Lake as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Security Lake before upgrading the Splunk Add-on for AWS to version 7.0.0 or later in order to avoid any data duplication and discrepancy issues.

Version 6.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Kinesis Firehose. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into your Splunk platform deployment.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues.

Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS.

If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Compatibility

Version 7.4.1 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.2.x, 9.0.x, 9.1.x
CIM 5.1.1 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, EventBridge (CloudWatch API), Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, AWS Security Hub findings, and Amazon Security Lake events

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 7.4.1 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Fixed an API loading issue for the Metadata Input.

Fixed issues

Version 7.4.1 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 7.4.1 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 7.4.1 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 7.4.0

Version 7.4.0 of the Splunk Add-on for Amazon Web Services was released on December 21, 2023.

Starting in version 7.1.0 of the Splunk Add-on for AWS, the file based checkpoint mechanism was migrated to the Splunk KV Store for Billing Cost and Usage Report, CloudWatch Metrics, and Incremental S3 inputs. The inputs must be disabled whenever the Splunk software is restarted. Otherwise, it will result in data duplication against your already configured inputs.

Version 7.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into your Splunk platform deployment.

If you use both the Splunk Add-on for Amazon Security Lake as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Security Lake before upgrading the Splunk Add-on for AWS to version 7.0.0 or later in order to avoid any data duplication and discrepancy issues.

Version 6.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Kinesis Firehose. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into your Splunk platform deployment.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues.

Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS.

If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Compatibility

Version 7.4.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.2.x, 9.0.x
CIM 5.1.1 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, EventBridge (CloudWatch API), Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, AWS Security Hub findings, and Amazon Security Lake events

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 7.4.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Added decoding support for parsing Kinesis Firehose error data. This significant improvement eliminates the necessity of employing a Lambda function for decoding purposes. Consequently, the use of Lambda for the re-ingestion of failed events from S3 is no longer required, streamlining the process and reducing complexity.
  • Enhanced UI experience features.
  • Minor bug fixes.

Fixed issues

Version 7.4.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 7.4.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 7.4.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 7.3.0

Version 7.3.0 of the Splunk Add-on for Amazon Web Services was released on November 10, 2023.

Starting in version 7.1.0 of the Splunk Add-on for AWS, the file based checkpoint mechanism was migrated to the Splunk KV Store for Billing Cost and Usage Report, CloudWatch Metrics, and Incremental S3 inputs. The inputs must be disabled whenever the Splunk software is restarted. Otherwise, it will result in data duplication against your already configured inputs.

Version 7.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into your Splunk platform deployment.

If you use both the Splunk Add-on for Amazon Security Lake as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Security Lake before upgrading the Splunk Add-on for AWS to version 7.0.0 or later in order to avoid any data duplication and discrepancy issues.

Version 6.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Kinesis Firehose. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into your Splunk platform deployment.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues.

Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS.

If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Compatibility

Version 7.3.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.2.x, 9.0.x
CIM 5.1.1 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, EventBridge (CloudWatch API), Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, AWS Security Hub findings, and Amazon Security Lake events

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 7.3.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • The file checkpoint mechanism was migrated to the Splunk KV store for Inspector, InspectorV2, ConfigRule, CloudwatchLogs and Kinesis inputs.
  • Updated existing Health Check Dashboards in order to enhance troubleshooting and performance monitoring. See AWS Health Check Dashboards for more information.

Fixed issues

Version 7.3.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 7.3.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 7.3.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 7.2.0

Version 7.2.0 of the Splunk Add-on for Amazon Web Services was released on October 17, 2023.

Compatibility

Version 7.2.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.2.x, 9.0.x
CIM 5.1.1 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, EventBridge (CloudWatch API), Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, AWS Security Hub findings, and Amazon Security Lake events

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 7.2.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Removed the AWS Lambda function dependency for the aws:cloudwatchlogs:vpcflow sourcetype.
  • Added support to fetch logs from AWS Organization level directory structures using the CloudTrail Incremental S3 input.
  • Enhanced throttle support for the Metadata input in order to mitigate throttling and limit errors.
  • Added the SNS message Max Age parameter to the SQS-based S3 input. This can be used to improve the efficiency of your data collection of messages within specified age limits.

Fixed issues

Version 7.2.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 7.2.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 7.2.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 7.1.0

Version 7.1.0 of the Splunk Add-on for Amazon Web Services was released on July 25, 2023.

Starting in version 7.1.0 of the Splunk Add-on for AWS, the file based checkpoint mechanism was migrated to the Splunk KV Store for Billing Cost and Usage Report, CloudWatch Metrics, and Incremental S3 inputs. The inputs must be disabled whenever the Splunk software is restarted. Otherwise, it will result in data duplication against your already configured inputs.

Version 7.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into your Splunk platform deployment.

If you use both the Splunk Add-on for Amazon Security Lake as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Security Lake before upgrading the Splunk Add-on for AWS to version 7.0.0 or later in order to avoid any data duplication and discrepancy issues.

Version 6.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Kinesis Firehose. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into your Splunk platform deployment.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues.

Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS.

If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Compatibility

Version 7.1.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.2.x, 9.0.x
CIM 5.1.1 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, EventBridge (CloudWatch API), Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, AWS Security Hub findings, and Amazon Security Lake events

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 7.1.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Added support for the following services for the AWS metadata input:
    • EKS
    • ElasticCache
    • EMR
    • GuardDuty
    • Network Firewall
    • Route 53
    • WAF
    • WAF v2
  • Enhancements have been made to the AWS metadata input for below mentioned services:
    • CloudFront
    • EC2
    • ELB
    • IAM
    • Kinesis Data Firehose
    • VPC
  • The file checkpoint mechanism was migrated to the Splunk KV store for Billing Cost and Usage Report, CloudWatch Metrics, and Incremental S3 inputs.

Fixed issues

Version 7.1.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 7.1.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 7.1.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 7.0.0

Version 7.0.0 of the Splunk Add-on for Amazon Web Services was released on May 18th, 2023.

Version 7.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into your Splunk platform deployment.

If you use both the Splunk Add-on for Amazon Security Lake as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Security Lake before upgrading the Splunk Add-on for AWS to version 7.0.0 or later in order to avoid any data duplication and discrepancy issues.

Version 6.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Kinesis Firehose. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into your Splunk platform deployment.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues.

Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS.

If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Compatibility

Version 7.0.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.2.x, 9.0.x
CIM 5.1.1 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, EventBridge (CloudWatch API), Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, AWS Security Hub findings, and Amazon Security Lake events

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 7.0.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Data input support for the Amazon Security Lake service. Users will now be able to ingest security events from Amazon Security Lake, normalized to the Open Cybersecurity Schema Framework (OCSF) schema. The Amazon Security Lake service makes AWS security events available as multi-event Apache Parquet objects in an S3 bucket. Each object has a corresponding SQS notification, once ready for download. Open Cybersecurity Schema Framework (OCSF) is an open-source project, delivering an extensible framework for developing schemas, along with a vendor-agnostic core security schema.

Fixed issues

Version 7.0.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 7.0.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 7.0.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 6.4.0

Version 6.4.0 of the Splunk Add-on for Amazon Web Services was released on April 19th, 2023.

Version 6.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Kinesis Firehose. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into Splunk.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues.

Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS.

If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Compatibility

Version 6.4.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.1.x, 8.2.x, 9.0.x
CIM 5.1.1 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, and AWS Security Hub findings events

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 6.4.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Enhanced CIM support of aws:securityhub:findings source type in order to support the new event format. (Consolidated controls feature)
  • Fixed CIM extractions for the app and user fields and added extractions for user_name in aws:securityhub:findings source type.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues. Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS. If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Fixed issues

Version 6.4.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 6.4.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 6.4.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 6.3.2

Version 6.3.2 of the Splunk Add-on for Amazon Web Services was released on February 23, 2023.

Version 6.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Kinesis Firehose. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into Splunk.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues.

Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS.

If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Compatibility

Version 6.3.2 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.1.x, 8.2.x, 9.0.x
CIM 4.20 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, and AWS Security Hub findings events

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 6.3.2 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Security related bug fixes. No new features added.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues. Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS. If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Fixed issues

Version 6.3.2 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 6.3.2 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 6.3.2 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 6.3.1

Version 6.3.1 of the Splunk Add-on for Amazon Web Services was released on January 23, 2022.

Version 6.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Kinesis Firehose. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into Splunk.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues.

Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS.

If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Compatibility

Version 6.3.1 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.1.x, 8.2.x, 9.0.x
CIM 4.20 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, and AWS Security Hub findings events

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 6.3.1 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Returned support for the AWS VPC default log format (v1-v2 fields only)
  • Fix for generic S3 upgrade issue

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues. Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS. If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Fixed issues

Version 6.3.1 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 6.3.1 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 6.3.1 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 6.3.0

Version 6.3.0 of the Splunk Add-on for Amazon Web Services was released on December 12, 2022.

Version 6.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Kinesis Firehose. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into Splunk.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues.

Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS.

If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Compatibility

Version 6.3.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.1.x, 8.2.x, 9.0.x
CIM 4.20 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, and AWS Security Hub findings events

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 6.3.0 of the Splunk Add-on for AWS version contains the following new and changed features:

Starting in version 6.3.0 of the Splunk Add-on for AWS, the VPC Flow log extraction format has been updated to include v3-v5 fields. Before upgrading to versions 6.3.0 and higher of the Splunk Add-on for AWS, Splunk platform deployments ingesting AWS VPC Flow Logs must update the log format in AWS VPC to include v3-v5 fields in order to ensure successful field extractions. For more information on updating the log format in AWS VPC, see the Configure VPC Flow Logs inputs for the Splunk Add-on for AWS topic in this manual.

  • Expanded support for VPC FlowLogs, sourcetype aws:cloudwatchlogs:vpcflow :
    • Ingestion of VPC flow logs via SQS-Based S3.
    • Support for the parsing of v3-v5 fields defined by AWS for VPC flow logs for both the Splunk defined custom log format and the select all log format.
    • Validation of the native delivery of VPC Flow Logs through Kinesis Firehose.
  • The addition of an iam_list_policy API to the Metadata input to fetch data related to:
    • Fetch all policies related to IAM using iam:ListPolicy.
    • Fetch permissions data using iam:GetPolicyVersion.
    • To link the users with policy, the following policies iam:ListUserPolicies and iam:ListAttachedUserPolicies were added to Iam_users data.
  • Support for the ingestion of OversizedChangeNotification events via the AWS Config > Config input.
  • Expanded support for Network Load Balancer (NLB) access logs. The new field elb_type was created to distinguish between ELB, ALB, and NLB access logs.
  • UI input page support to enable/disable CSV parsing and custom delimiter definition for Generic S3 & SQS-based S3.

Fields added and fields removed

See the following list of fields added and fields removed between the Splunk Add-on for AWS 6.2.0 and 6.3.0:

Source-type app Fields added Fields removed
[u'aws:elb:accesslogs'] AWS ELB alpn_client_preference_list, destination_ip, connection_time, tls_named_group, log_version, chosen_cert_arn, alpn_be_protocol, domain_name, listener, tls_cipher, chosen_cert_serial, tls_handshake_time, elb_type, tls_protocol_version, destination_port, type, alpn_fe_protocol, incoming_tls_alert
Source-type action Fields added Fields removed
[u'aws:cloudwatchlogs:vpcflow'] unknown tcp_flags, flow_direction, pkt_dstaddr, subnet_id, instance_id, traffic_path, pkt_srcaddr, sublocation_type, pkt_dst_aws_service, sublocation_id, vpc_id, type, az_id, pkt_src_aws_service timestamp
[u'aws:cloudwatchlogs:vpcflow'] blocked, allowed tcp_flags, flow_direction, pkt_dstaddr, subnet_id, instance_id, traffic_path, pkt_srcaddr, sublocation_type, pkt_dst_aws_service, sublocation_id, vpc_id, type, az_id, pkt_src_aws_service

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues. Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS. If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Fixed issues

Version 6.3.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 6.3.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 6.3.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 6.2.0

Version 6.2.0 of the Splunk Add-on for Amazon Web Services was released on July 28th, 2022.

Version 6.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Kinesis Firehose. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into Splunk.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues.

Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS.

If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Compatibility

Version 6.2.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.0 and later
CIM 4.20 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector Classic, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, and AWS Security Hub findings events

Versions 5.0.0 and above of the Splunk Add-on for AWS are Python 3 releases, and only compatible with Splunk platform versions 8.0.0 and later. To use version 5.0.0 or later of this add-on, upgrade your Splunk platform deployment to version 8.0.0 or later. For users of Splunk platforms 6.x.x and Splunk 7.x.x, the Splunk Add-on for Amazon Web Services version 4.6.1 is supported. Do not upgrade to Splunk Add-on for AWS 5.0.0 or above on these versions of the Splunk platform.

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 6.2.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Support for the Inspector v2 API ingestion method.
  • Added Common Information Model (CIM) mappings for Inspector v2.
  • Deprecation of the Description Input
  • Added UI warning message and warning logs for Generic S3 inputs.
  • Bug fixes.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues. Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS. If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Fixed issues

Version 6.2.0.of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 6.2.0.of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 6.2.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 6.1.0

Version 6.1.0 of the Splunk Add-on for Amazon Web Services was released on July 11, 2022

Version 6.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Kinesis Firehose. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into Splunk.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues.

Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS.

If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Compatibility

Version 6.1.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.0 and later
CIM 4.20 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, and AWS Security Hub findings events

Versions 5.0.0 and above of the Splunk Add-on for AWS are Python 3 releases, and only compatible with Splunk platform versions 8.0.0 and later. To use version 5.0.0 or later of this add-on, upgrade your Splunk platform deployment to version 8.0.0 or later. For users of Splunk platforms 6.x.x and Splunk 7.x.x, the Splunk Add-on for Amazon Web Services version 4.6.1 is supported. Do not upgrade to Splunk Add-on for AWS 5.0.0 or above on these versions of the Splunk platform.

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 6.1.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Support for the parsing of CSV files from AWS S3 (Generic S3 and SQS-based S3 ingestion methods)
  • Bug fixes.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues. Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS. If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Fixed issues

Version 6.1.0.of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 6.1.0.of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 6.1.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 6.0.0

Version 6.0.0 of the Splunk Add-on for Amazon Web Services was released on May 3, 2022

Version 6.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Kinesis Firehose. Configure the Splunk Add-on for AWS to ingest across all AWS data sources for ingesting AWS data into Splunk.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues.

Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS.

If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Compatibility

Version 6.0.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.0 and later
CIM 4.20 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, SNS, AWS Identity and Access Management (IAM) Access Analyzer, and AWS Security Hub findings events

Versions 5.0.0 and above of the Splunk Add-on for AWS are Python 3 releases, and only compatible with Splunk platform versions 8.0.0 and later. To use version 5.0.0 or later of this add-on, upgrade your Splunk platform deployment to version 8.0.0 or later. For users of Splunk platforms 6.x.x and Splunk 7.x.x, the Splunk Add-on for Amazon Web Services version 4.6.1 is supported. Do not upgrade to Splunk Add-on for AWS 5.0.0 or above on these versions of the Splunk platform.

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 6.0.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Version 6.0.0 of the Splunk Add-on for AWS includes a merge of all the capabilities of the Splunk Add-on for Amazon Kinesis Firehose:
    • Provided support of all the following vendor products which were supported in the Splunk Add-on for Amazon Kinesis Firehose: AWS Identity and Access Management (IAM) Access Analyzer, and AWS Security Hub findings events.
    • Support for HTTP Event Collector (HEC) data collection for AWS Cloudtrail, AWS VPC Flowlogs, AWS Guardduty, AWS Identity and Access Management (IAM) Access Analyzer and AWS Security Hub findings.
    • Support for the aws:cloudwatch:guardduty Splunk Add-on for Kinesis Firehose sourcetype. Support for the aws:cloudwatchlogs:guardduty sourcetype will be added to a future release of the Splunk Add-on for Amazon Web Services.
  • Improved Common Information Model (CIM) mappings.
  • UI component upgrades for compatibility with future versions of the Splunk software (Fast and intuitive UI with an improved look and feel).
  • Added signature validation for SNS/SQS messages.
  • Added Data Manager banner on the Splunk Add-on for AWS home page.
  • Updated the source for the Metadata data input to match Data Manager functionality.

If you use both the Splunk Add-on for Amazon Kinesis Firehose as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Kinesis Firehose after upgrading the Splunk Add-on for AWS to version 6.0.0 or later in order to avoid any data duplication and discrepancy issues. Data that you previously onboarded through the Splunk Add-on for Amazon Kinesis Firehose will still be searchable, and your existing searches will be compatible with version 6.0.0 of the Splunk Add-on for AWS. If you are not currently using the Splunk Add-on for Amazon Kinesis Firehose, but plan to use it in the future, then the best practice is to download and configure version 6.0.0 or later of the Splunk Add-on for AWS, instead of the Splunk Add-on for Amazon Kinesis Firehose.

Fixed issues

Version 6.0.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 6.0.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Added/Removed Common Information Model Fields

See the following table for a list of fields added/removed CIM fields between Splunk Add-on for Amazon Web Services v5.2.2 and v6.0.0:

Sourcetype eventName Fields added in AWS 5.2.2 Fields removed in AWS 6.0.0
['aws:cloudtrail'] DeleteNetworkInterface object_id, action, status, user, src_user_type, object_attrs, src_user, user_id, object
['aws:cloudtrail'] UpdateUser user_id
Source-type source Fields added in AWS 5.2.2 Fields removed in AWS 6.0.0
['aws:metadata'] All image_id

See the following table for a list of fields added/removed between Splunk Add-on for Amazon Kinesis Firehose v1.3.2 and Splunk Add-on for Amazon Web Services v6.0.0:

Source-type eventName Fields added in Kinesis 1.3.2 Fields removed in AWS 6.0.0
['aws:cloudtrail'] ListAliases object_attrs
Source-type State Fields added in Kinesis 1.3.2 Fields removed in AWS 6.0.0
['aws:metadata'] All availability_zone, instance_tenancy, currency_code, instance_count, duration, fixed_price, end, region, description, vm_os, vendor_region, start, vendor_product, offering_type, state, mem_capacity, vm_size, cpu_cores, usage_price, aws_account_id, vendor_account, id
Source-type source Fields added in Kinesis 1.3.2 Fields removed in AWS 6.0.0
['aws:securityhub:finding'] aws_eventbridgeevents_securityhub instance_extract, vpc_extract, accesskey_extract, volume_extract, security_group_extract, managed_instance_extract, s3bucket_extract

See the following table for a list of fields modified between Splunk Add-on for Amazon Web Services v5.2.2 and v6.0.0:

Sourcetype

CIM Field

eventName, Resources{}.Type

Vendor Field in AWS 5.2.2

Vendor Field in AWS 6.0.0

aws:cloudtrail

user

eventName: ConsoleLogin

userIdentity.principalId,
example: AIDA3HRA7T6MUVTYUHPKV

userIdentity.principalId OR userIdentity.userName,
example: AIDA3HRA7T6MUVTYUHPKV, test_user

user_id

eventName: CreateUser, DeleteUser

userIdentity.principalId OR userIdentity.accountId OR userIdentity.sessionContext.sessionIssuer.principalId,
example: AIDA3HRA7T6MUVTYUHPKV

userIdentity.principalId OR userIdentity.accountId OR userIdentity.sessionContext.sessionIssuer.principalId OR userIdentity.userName,
example: AIDA3HRA7T6MUVTYUHPKV, test_user

action

eventName: DeleteLoginProfile

Static Value: deleted,unknown

Static Value: modified

object_category

eventName: DeleteNetworkInterface

Static Value: unknown

Static Value: network_interface

user_type

eventName: DeleteNetworkInterface

userIdentity.type,
example: Assume Role

sessionContext.sessionIssuer.type,
example: Role

See the following table for a list of fields modified between Splunk Add-on for Amazon Kinesis Firehose v1.3.2 and Splunk Add-on for Amazon Web Services v6.0.0:

Sourcetype

CIM Field

eventName, Resources{}.Type

Vendor Field in Kinesis 1.3.2

Vendor Field in AWS 6.0.0

aws:cloudtrail

action

eventName: DeleteLoginProfile

Static Value: deleted, unknown

Static Value: modified

status

eventName: DeleteNetworkInterface

Static Value: failure

Static Value: failure, success

aws:cloudwatchlogs:vpcflow

dvc

All

Static Value: VPC Flow

interface_id,
example: eni-11302624

aws:metadata

account_id

All

account_id,
example: 906585968227

OwnerId,
example: 404565499102

aws:securityhub:finding

dest

Resources{}.Type: AwsEc2Instance, AwsEc2Volume, AwsIamAccessKey, AwsS3Bucket, AwsEc2Volume, AwsEc2Vpc

Resources.Details.AwsEc2Instance.IpV4Addresses,
example: 127.0.0.1

Resources{}.Id,
i-0259101da3a8675d0

dest_name

Resources{}.Type: AwsEc2Instance, AwsEc2Volume, AwsIamAccessKey, AwsS3Bucket, AwsEc2Volume, AwsEc2Vpc

Resources{}.Id,
i-0259101da3a8675d0

CIM model changes

Source eventName Previous CIM model in AWS 5.2.2 New CIM model in AWS 6.0.0
Sourcetype State Previous CIM model in Kinesis 1.3.2 New CIM model in AWS 6.0.0
aws:metadata All Inventory.All_Inventory.Virtual_OS.Snapshot

Third-party software attributions

Version 6.0.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Third-party software attributions for the Splunk Add-on for Amazon Web Services

Version 5.2.0

Version 5.2.0 of the Splunk Add-on for Amazon Web Services was released on October 4, 2021.

Compatibility

Version 5.2.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.0 and later
CIM 4.20 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, and SNS.

Versions 5.0.0 and above of the Splunk Add-on for AWS are Python 3 releases, and only compatible with Splunk platform versions 8.0.0 and later. To use version 5.0.0 or later of this add-on, upgrade your Splunk platform deployment to version 8.0.0 or later. For users of Splunk platforms 6.x.x and Splunk 7.x.x, the Splunk Add-on for Amazon Web Services version 4.6.1 is supported. Do not upgrade to Splunk Add-on for AWS 5.0.0 or above on these versions of the Splunk platform.

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 5.2.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • CIM 4.20 compatibility and enhanced CIM mapping
  • UI component upgrades (jQuery) that are compatible with future versions of the Splunk software.
  • The aws:cloudtrail sourcetype is updated for app field mapping.

See the following tables for information on field changes between 5.1.0 and 5.2.0:

Source-type Fields added Fields removed
aws:cloudfront:accesslogs action, app, bytes, bytes_in, bytes_out, c_port, category, cs_protocol_version, dest, duration, fle_encrypted_fields, fle_status, http_content_type, http_method, http_referrer, http_referrer_domain, http_user_agent, http_user_agent_length, response_time, sc_content_len, sc_content_type, sc_range_end, sc_range_start, src,src_ip, src_port, status, time_to_first_byte, uri_path, url, url_domain, url_length, vendor_product, x_edge_detail_result_type
aws:cloudtrail action, authentication_method, change_type, dest, men_free, object, object_attrs, object_id, rule_action, src_user, src_user_name, src_user_type, status, user_name, vendor_account, vendor_product user_agent, user_id, user_type
aws:cloudwatchlogs:guardduty body, findingType
aws:cloudwatchlogs:vpcflow app, protocol_version, user_id, vendor_product,
aws:config object_id, object_path, result, vendor_account, vendor_product,
aws:config:notification object_attrs, object_path, result, user, vendor_product
aws:description enabled, user_id, family, status, description, time, type, snapshot
aws:elb:accesslogs ActionExecuted, ChosenCertArn, ClientPort, DomainName, ELB, ELBStatusCode, ErrorReason, MatchedRulePriority, ReceivedBytes, RedirectUrl, Request, RequestCreationTime, RequestProcessingTime, RequestTargetIP, RequestTargetPort, RequestType, ResponseProcessingTime, ResponseTime, SSLCipher, SSLProtocol, SentBytes, TargetGroupArn, TargetPort, TargetProcessingTime, TargetStatusCode, TraceId, UserAgent, action, app, bytes, bytes_in, bytes_out, category, dest, dest_port, http_method, http_user_agent, http_user_agent_length, response_time, src, src_ip, src_port, status, url, url_length, vendor_product
aws:metadata enabled, region, snapshot, status, time, user_id, vendor_region
aws:s3 AuthType, BucketCreationTime, BucketName, BucketOwner, BytesSent, CipherSuite, ErrorCode, HTTPMethod, HTTPStatus, HostHeader, HostId, ObjectSize, OperationKey, Referer, RemoteIp, RequestID, RequestKey, RequestURI, RequestURIPath, Requester, SignatureVersion, TLSVersion, TotalTime, TurnAroundTime, UserAgent, VersionId, action, bytes, bytes_out, category, dest, error_code, http_method, http_user_agent, http_user_agent_length, operation,response_time, src, src_ip, status, storage_name, url, url_domain, url_length, user, vendor_product
aws:s3:accesslogs action, category, http_referrer, http_referrer_domain, http_user_agent_length, src_ip,status, storage_name, url, url_length, vendor_product

See the following table for a list of fields modified between 5.1.0 and 5.2.0:

Sourcetype

CIM Field

eventName, resourceID, resourceType, or source

Vendor Field in 5.1.0

Vendor Field in 5.2.0

aws:cloudtrail

app

eventName: All

eventSource,
example: sts.amazonaws.com

eventType,
example: AwsApiCall

user

eventName: AssumeRole

userIdentity.principalId,
example: AIDA3HRA7T6MUVTYUHPKV

requestParameters.roleArn OR responseElements.assumedRoleUser.arn,
example: Role2WithTags

eventNames: AssumeRoleWithSAML, AssumeRoleWithWebIdentity

userIdentity.principalId,
example: AIDA3HRA7T6MUVTYUHPKV

requestParameters.roleArn,
example: arnRoleSession@abc.com

eventNames: AttachVolume, AuthorizeSecurityGroupEgress, AuthorizeSecurityGroupIngress, CheckMfa, ConsoleLogin, CreateAccessKey, CreateBucket, CreateChangeSet, CreateDeliveryStream, CreateFunction20150331, CreateKeyspace, CreateLoadBalancerListeners, CreateLoadBalancerPolicy, CreateLogGroup, CreateLogStream, CreateLoginProfile, CreateNetworkAcl, CreateNetworkAclEntry, CreateNetworkInterface, CreateQueue, CreateSecurityGroup, CreateTable, CreateUser, CreateVirtualMFADevice, CreateVolume, DeleteNetworkAcl, DeleteNetworkAclEntry, DeleteSecurityGroup, DeleteVolume, DetachVolume, GetFederationToken, GetSessionToken, PutBucketAcl, PutBucketPublicAccessBlock, PutObject, RebootInstances, RevokeSecurityGroupEgress, ReplaceNetworkAclAssociation, ReplaceNetworkAclEntry, RevokeSecurityGroupIngress

userIdentity.principalId,
example: AIDA3HRA7T6MUVTYUHPKV

userIdentity.userName,
example: test_user

eventNames: GetAccountSummary, GetUser, ListAccessKeys, ListAccountAliases, ListSigningCertificates - Failure Event

userIdentity.principalId,
example: AIDA3HRA7T6MUVTYUHPKV

errorMessage,
example: userName

eventNames: GetBucketEncryption, ListAliases, ListRoles

userIdentity.principalId,
example: AIDA3HRA7T6MUVTYUHPKV

userIdentity.sessionContext.sessionIssuer.userName,
example: SessionUserName

eventName: PutBucketAcl

requestParameters.AccessControlPolicy.AccessControlList.Grant{}.Grantee.DisplayName OR requestParameters.AccessControlPolicy.AccessControlList.Grant{}.Grantee.URI,
example: splunk_aws_dsg_sa

userIdentity.userName,
example: test_user

eventNames: RunInstances, StartInstances, StopInstances, TerminateInstances

userIdentity.principalId,
example: AIDA3HRA7T6MUVTYUHPKV

userIdentity.userName OR userIdentity.sessionContext.sessionIssuer.userName,
example: test_user

eventName: UpdateUser

requestParameters.userName,
example: OldUserName

requestParameters.newUserName,
example: test_new_user

user_type

eventNames: AssumeRole, AssumeRoleWithSAML, AssumeRoleWithWebIdentity

userIdentity.type,
example: AWS::IAM::Role

resources{}.type OR responseElements.assumedRoleUser.arn,
example: AWS::IAM::Role

eventNames: ListAliases, ListRoles

userIdentity.type,
example: AWS::IAM::Role

userIdentity.sessionContext.sessionIssuer.type,
example: Role

eventName: PutBucketAcl

requestParameters.AccessControlPolicy.AccessControlList.Grant{}.Grantee.xsi:type,
example: CanonicalUser

userIdentity.type,
example: AWS::IAM::Role

src_user

eventNames: AssumeRole, AssumeRoleWithSAML, AssumeRoleWithWebIdentity

userIdentity.principalId,
example: AIDA3HRA7T6MUVTYUHPKV

userIdentity.userName OR requestParameters.sourceIdentity OR userIdentity.sessionContext.sessionIssuer.userName,
example: test_user

eventName: CreateUser

userIdentity.principalId,
example: AIDA3HRA7T6MUVTYUHPKV:abc@abc.com

userIdentity.principalId,
example: abc@abc.com

eventNames: DeleteUser, GetUser, PutBucketAcl, UpdateUser

userIdentity.principalId,
example: AIDA3HRA7T6MUVTYUHPKV

userIdentity.userName,
example: test_user

src_user_id

eventNames: AssumeRole, AssumeRoleWithSAML

userIdentity.principalId,
example: AIDA3HRA7T6MUVTYUHPKV:abc@abc.com

userIdentity.principalId OR userIdentity.sessionContext.sessionIssuer.principalId,
example: AIDA3HRA7T6MUVTYUHPKV

eventName: rowspan="4"|user_id

AssumeRole, AssumeRoleWithSAML, AssumeRoleWithWebIdentity,
example: responseElements.assumedRoleUser.assumedRoleId

userIdentity.principalId,
example: AIDA3HRA7T6MUVTYUHPKV

responseElements.assumedRoleUser.assumedRoleId

eventNames: AttachVolume, AuthorizeSecurityGroupEgress, AuthorizeSecurityGroupIngress, CreateAccessKey, CreateBucket, CreateChangeSet, CreateDeliveryStream, CreateFunction20150331, CreateNetworkAcl, CreateNetworkAclEntry, CreateSecurityGroup, CreateTable, CreateVirtualMFADevice, DeleteBucket, DeleteNetworkAcl, DeleteSecurityGroup, DeleteVolume, GetAccountSummary, ListSigningCertificates, PutBucketPublicAccessBlock, RebootInstances, ReplaceNetworkAclEntry, RevokeSecurityGroupEgress, RevokeSecurityGroupIngress, RunInstances, StartInstances, StopInstances, TerminateInstances

userIdentity.principalId,
example: AIDA3HRA7T6MUVTYUHPKV

userIdentity.userName,
example: test_user

eventName: ConsoleLogin

userIdentity.principalId,
example: AIDA3HRA7T6MUVTYUHPKV:abc@abc.com

userIdentity.principalId OR userIdentity.accountId OR userIdentity.sessionContext.sessionIssuer.principalId,
example: AIDA3HRA7T6MUVTYUHPKV

eventNames: ListAliases, ListRoles

userIdentity.principalId,
example: AROACKCEVSQ6C2EXAMPLE:Session_Name

userIdentity.sessionContext.sessionIssuer.principalId,
example: AROACKCEVSQ6C2EXAMPLE

object_category

eventNames: AttachVolume, DeleteVolume, DetachVolume

Static Value: disk

Static Value: volume

eventNames: AuthorizeSecurityGroupEgress, AuthorizeSecurityGroupIngress, CreateSecurityGroup, DeleteSecurityGroup, RevokeSecurityGroupEgress, RevokeSecurityGroupIngress

Static Value: firewall

Static Value: security_group

eventNames: CreateAccessKey, CreateLoginProfile, CreateVirtualMFADevice, GetAccountSummary, GetUser, ListAccessKeys, ListAccountAliases, ListRoles, ListSigningCertificates

Static Value: unknown

Static Value: user

eventNames: CreateBucket, DeleteBucket, PutBucket, PublicAccessBlock, PutObject

Static Value: storage

Static Value: bucket

eventName: CreateChangeSet

Static Value: unknown

Static Value: stack

eventName: CreateDeliveryStream

Static Value: unknown

Static Value: delivery_stream

eventName: CreateFunction20150331

Static Value: unknown

Static Value: function

eventName: CreateKeyspace

Static Value: unknown

Static Value: keyspace

eventNames: CreateLoadBalancerListeners, CreateLoadBalancerPolicy

Static Value: unknown

Static Value: load_balancer

eventName: CreateLogGroup

Static Value: unknown

Static Value: log_group

eventName: CreateLogStream

Static Value: unknown

Static Value: log_stream

eventNames: CreateNetworkAcl, CreateNetworkAclEntry, DeleteNetworkAcl, DeleteNetworkAclEntry, ReplaceNetworkAclAssociation, ReplaceNetworkAclEntry

Static Value: unknown

Static Value: ACL

eventName: CreateNetworkInterface

Static Value: unknown

Static Value: network_interface

eventName: CreateQueue

Static Value: unknown

Static Value: message_queue

eventName: CreateTable

Static Value: unknown

Static Value: table

eventNames: GetBucketEncryption, PutBucketAcl

Static Value: unknown

Static Value: bucket

eventName: ListAliases

Static Value: unknown

Static Value: alias

user_idchange_type

eventNames: AttachVolume, CreateVolume, DeleteVolume, DetachVolume

Static Value: EC2

Static Value: storage

eventNames: AuthorizeSecurityGroupEgress, AuthorizeSecurityGroupIngress, CreateNetworkAcl, CreateNetworkAclEntry, CreateNetworkInterface, CreateSecurityGroup, DeleteNetworkAcl, DeleteNetworkAclEntry, DeleteSecurityGroup, ReplaceNetworkAclAssociation, ReplaceNetworkAclEntry, RevokeSecurityGroupEgress, RevokeSecurityGroupIngress

Static Value: EC2

Static Value: firewall

eventNames: CreateAccessKey, CreateLoginProfile, CreateUser, CreateVirtualMFADevice, DeleteUser, GetAccountSummary, GetUser, ListAccessKeys, ListAccountAliases, ListRoles, ListSigningCertificates, ListSigningCertificates, UpdateUser

Static Value: IAM

Static Value: AAA

eventNames: GetFederationToken, GetSessionToken

Static Value: STS

Static Value: AAA

eventNames: RunInstances, RebootInstances, StartInstances, StopInstances, TerminateInstances

Static Value: EC2

Static Value: virtual_server

dest

eventName: AttachVolume

requestParameters.volumeId,
example: vol-3ox0otf8xaqxrptxi

requestParameters.instanceId,
example: i-3ox0otf8xaqxrptxi

eventNames: AuthorizeSecurityGroupEgress, AuthorizeSecurityGroupIngress, CreateSecurityGroup, RevokeSecurityGroupEgress, RevokeSecurityGroupIngress

requestParameters.groupId,
example: sg-gnzeup7yzumo3f40i

eventSource,
example: ec2.amazonaws.com

eventName: ConsoleLogin

eventSource,
example: ec2.amazonaws.com

additionalEventData.LoginTo OR eventSource,
example: https://console.aws.amazon.com/console/home

eventNames: CreateBucket, DeleteBucket, GetBucketEncryption, PutBucketAcl, PutBucketPublicAccessBlock, PutObject

requestParameters.bucketName,
example: bucket1

requestParameters.Host OR requestParameters.host{},
example: s3-us-east-2.amazonaws.com

eventNames: CreateNetworkAcl, CreateNetworkAclEntry

requestParameters.networkAclId OR responseElements.networkAcl.networkAclId,
example: acl-328f8f90a8e21dc7e

eventSource,
example: ec2.amazonaws.com

eventName: CreateUser

responseElements.user.userId,
example: UB9BNXNERJHO8APB

eventSource,
example: iam.amazonaws.com

eventNames: CreateVolume, DeleteVolume

responseElements.volumeId,
example: vol-pjk4yh53x5xy3kldx

eventSource,
example: ec2.amazonaws.com

eventNames: DeleteUser, UpdateUser

requestParameters.userName,
example: test_user

eventSource,
example: iam.amazonaws.com

eventName: DetachVolume

responseElements.volumeId,
example: vol-pjk4yh53x5xy3kldx

responseElements.instanceId,
example: i-3ox0otf8xaqxrptxi

eventNames: RunInstances, StartInstances

responseElements.instancesSet.items{}.instanceId,
example: i-pjk4yh53x5xy3kldx

responseElements.instancesSet.items{}.instanceId OR eventSource,
example: i-pjk4yh53x5xy3kldx

action

eventNames: CreateAccessKey, CreateLoginProfile, CreateNetworkAclEntry, CreateVirtualMFADevice, DeleteNetworkAclEntry

Static Value: created

Static Value: modified

eventNames: GetAccountSummary, GetUser, ListAccessKeys, ListAccountAliases, ListSigningCertificates

Static Value: unknown

Static Value: read

protocol

eventName: CreateNetworkAclEntry

Static Value: TCP

Static Value: IP

object_attrs

eventName: PutBucketAcl

requestParameters.AccessControlPolicy.AccessControlList.Grant{}.Permission,
example: "READ READ_ACP WRITE FULL_CONTROL"

Static value: AccessControlList

object

eventName: RunInstances

responseElements.instancesSet.items{}.instanceId,
example: i-pjk4yh53x5xy3kldx

responseElements.instancesSet.items{}.instanceId OR eventSource,
example: i-pjk4yh53x5xy3kldx

eventName: StartInstances

requestParameters.instancesSet.items{}.instanceId,
example: i-pjk4yh53x5xy3kldx

requestParameters.instancesSet.items{}.instanceId OR eventSource,
example: ec2.amazonaws.com

eventName: UpdateUser

requestParameters.userName,
example: test_user

requestParameters.newUserName,
example: test_new_user

object_id

eventName: StartInstances

requestParameters.instancesSet.items{}.instanceId, example: i-pjk4yh53x5xy3kldx

requestParameters.instancesSet.items{}.instanceId OR eventSource, example: i-pjk4yh53x5xy3kldx

eventName: UpdateUser

requestParameters.userName,
example: test_user

requestParameters.newUserName,
example: test_new_user

aws:config

object_category

resourceIDs: AWS::Redshift::ClusterSnapshot, AWS::Config::ResourceCompliance

Static Value: unknown

Statc Value: file

object_id

resourceIDs: AWS::Redshift::ClusterSnapshot, AWS::EC2::NetworkInterface

ARN,
example: arn:aws:redshift:eu-central-2:00000:snapshot:redshift-cluster-1/rs:redshift-cluster-1-2021-10-11-12-32-53

resourceId,
example: rs:redshift-cluster-1-2021-10-11-12-33-00

aws:config:notification

object_category

resourceTypes: AWS::Config::ResourceCompliance, AWS::Redshift::ClusterSnapshot

Static Value: unknown

Static Value: file

object_id

resourceTypes: All

N/A

resourceId,
example: rs:redshift-cluster-1-2021-10-11-12-33-00

aws:description

user_id

source: All

UserId,
example: ZWV5FIRT1Q4ZOFCQML63P

UserID,
example: account_Id, ZWV5FIRT1Q4ZOFCQML63P

status

source: *ec2_instances

status,
example: completed

image.attributes.state OR state OR status,
example: completed, available

aws:cloudwatchlogs:guardduty

dest_type

N/A

Static value from lookup,
example: user

detail.resource.resourceType,
example: AccessKey

user

N/A

detail.resource.accessKeyDetails.principleId,
example: GeneratedFindingPrincipalId

detail.resource.accessKeyDetails.userName,
example: test_user

severity

N/A

Static Value: LOW, MEDIUM, HIGH

Static Value: low, medium, high

aws:s3:accesslogs

bytes

N/A

bytes,
example: 0

bytes_sent,
example: 470

response_time

N/A

turn_around_time,
example: 0

total_time,
example: 25

CIM model changes

See the following CIM model changes between 5.1.0 and 5.2.0:

Sourcetype metric_name Previous CIM model New CIM model
aws:cloudwatch FreeableMemory Database:Stats, All_Performance:Memory All_Performance:Memory
Sourcetype eventName Previous CIM model New CIM model
aws:cloudtrail AssumeRole, AssumeRoleWithSAML, AssumeRoleWithWebIdentity, GetFederationToken, GetSessionToken Authentication:Default_Authentication
aws:cloudtrail GetBucketEncryption, PutBucketAcl Change:Account_Management Change:All_Changes
aws:cloudtrail GetBucketEncryption, PutBucketAcl Change:Account_Management Change:All_Changes
aws:cloudtrail ListRoles, ListAliases Change:All_Changes
aws:cloudtrail RunInstances Change:Endpoint_Changes, Change:Instance_Changes Change:Instance_Changes
Sourcetype source Previous CIM model New CIM model
aws:description *:ec2_instances, *:ec2_images All_Inventory All_Inventory:Virtual_OS:Snapshot
aws:description *:ec2_instances All_Inventory All_Inventory:Virtual_OS:Snapshot
aws:inspector *:inspector:assessmentRun All_Inventory:Newtwok, All_Inventory:User, All_Inventory:Virtual_OS:Snapshot
Sourcetype Previous CIM model New CIM model
aws:cloudfront:accesslogs, aws:elb:accesslogs Web
aws:cloudwatchlogs:guardduty Alerts, Malware_Attacks Alerts
aws:config:rule All_Inventory:Network, All_Inventory:Virtual_OS:Snapshot Alerts
aws:s3 Web:Storage

Fixed issues

Version 5.2.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 5.2.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 5.2.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 5.1.0

Version 5.1.0 of the Splunk Add-on for Amazon Web Services was released on July 2, 2021.

Compatibility

Version 5.1.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.0 and later
CIM 4.18 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, Metadata, SQS, and SNS.

Versions 5.0.0 and above of the Splunk Add-on for AWS are Python 3 releases, and only compatible with Splunk platform versions 8.0.0 and later. To use version 5.0.0 or later of this add-on, upgrade your Splunk platform deployment to version 8.0.0 or later. For users of Splunk platforms 6.x.x and Splunk 7.x.x, the Splunk Add-on for Amazon Web Services version 4.6.1 is supported. Do not upgrade to Splunk Add-on for AWS 5.0.0 or above on these versions of the Splunk platform.

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 5.1.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • A new data input called Metadata. The Metadata input , which can be accessed in Splunk Web by clicking Create New Input > Description > Metadata, uses the boto3 package to collect Description data. See the Metadata input topic in this manual for more information.
  • Migrated the following data inputs from the boto2 package to the boto3 package:
    • Cloudtrail
    • Config
    • Cloudwatch logs.
    • Generic S3
  • Support for Regional endpoints for all data inputs. Each API call can be made to a region-specific endpoint, instead than a public endpoint.

  • Support for private endpoints for the following data inputs:

    • Billing Cost and Usage Reports (CUR)
    • Cloudtrail
    • Cloudwatch
    • Cloudwatch Logs
    • Generic S3
    • Incremental S3
    • Kinesis
    • SQS-based S3

    Private endpoints can perform account authentication and data collection for each supported input. For example, a Splunk instance within a Virtual Private Cloud (VPC) infrastructure. - Support for disabling the DLQ (Dead Letter Queue) check for SQS-based S3 Crowdstrike event inputs.

The Description input will be deprecated in a future release. The Metadata input has been added as a replacement. The best practice is to begin moving your workloads to the Metadata input.

Fixed issues

Version 5.1.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 5.1.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 5.1.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 5.0.4

Version 5.0.4 of the Splunk Add-on for Amazon Web Services was released on June 2, 2021.

Compatibility

Version 5.0.4 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.0 and later
CIM 4.18 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, SQS, and SNS.

Versions 5.0.0 and above of the Splunk Add-on for AWS are Python 3 releases, and only compatible with Splunk platform versions 8.0.0 and later. To use version 5.0.0 or later of this add-on, upgrade your Splunk platform deployment to version 8.0.0 or later. For users of Splunk platforms 6.x.x and Splunk 7.x.x, the Splunk Add-on for Amazon Web Services version 4.6.1 is supported. Do not upgrade to Splunk Add-on for AWS 5.0.0 or above on these versions of the Splunk platform.

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 5.0.4 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Simple Queue Service (SQS) modular input support for Crowdstrike Falcon Data Replicator (FDR)
  • Bug fixes.

Fixed issues

Version 5.0.4 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 5.0.4 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

The Splunk Add-on for AWS version 5.x.x is incompatible with Splunk Enterprise versions 7.x.x and earlier.

Third-party software attributions

Version 5.0.4 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 5.0.3

Version 5.0.3 of the Splunk Add-on for Amazon Web Services was released on October 8, 2020.

Compatibility

Version 5.0.3 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.0 and later
CIM 4.3 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, SQS, and SNS.

Versions 5.0.0 and above of the Splunk Add-on for AWS are Python 3 releases, and only compatible with Splunk platform versions 8.0.0 and later. To use version 5.0.0 or later of this add-on, upgrade your Splunk platform deployment to version 8.0.0 or later. For users of Splunk platforms 6.x.x and Splunk 7.x.x, the Splunk Add-on for Amazon Web Services version 4.6.1 is supported. Do not upgrade to Splunk Add-on for AWS 5.0.0 or above on these versions of the Splunk platform.

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 5.0.3 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Bug fix with proxy behavior not working as expected.
  • Bug fix with no_proxy taking effect with https.
  • SQS modular input for proxy configuration code fix (Microsoft Windows only)

Fixed issues

Version 5.0.3 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 5.0.3 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

The Splunk Add-on for AWS version 5.x.x is incompatible with Splunk Enterprise versions 7.x.x and earlier.

Third-party software attributions

Version 5.0.3 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 5.0.2

Version 5.0.2 of the Splunk Add-on for Amazon Web Services was released on August 22, 2020.

Compatibility

Version 5.0.2 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.0 and later
CIM 4.3 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, SQS, and SNS.

Versions 5.0.0 and above of the Splunk Add-on for AWS are Python 3 releases, and only compatible with Splunk platform versions 8.0.0 and later. To use version 5.0.0 or later of this add-on, upgrade your Splunk platform deployment to version 8.0.0 or later. For users of Splunk platforms 6.x.x and Splunk 7.x.x, the Splunk Add-on for Amazon Web Services version 4.6.1 is supported. Do not upgrade to Splunk Add-on for AWS 5.0.0 or above on these versions of the Splunk platform.

New features

Version 5.0.2 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Increased Network Traffic CIM data model compatibility.
  • Increased Change CIM data model compatibility.
  • Improved support for the Splunk Enterprise Security Assets and Identities Framework Interface

Fixed issues

Version 5.0.2 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 5.0.2 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

The Splunk Add-on for AWS version 5.x.x is incompatible with Splunk Enterprise versions 7.x.x and earlier.

Third-party software attributions

Version 5.0.2 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 5.0.1

Version 5.0.1 of the Splunk Add-on for Amazon Web Services was released on May 13, 2020.

Compatibility

Version 5.0.1 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.0 and later
CIM 4.3 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, SQS, and SNS.

Versions 5.0.0 and above of the Splunk Add-on for AWS are Python 3 releases, and only compatible with Splunk platform versions 8.0.0 and later. To use version 5.0.0 or later of this add-on, upgrade your Splunk platform deployment to version 8.0.0 or later. For users of Splunk platforms 6.x.x and Splunk 7.x.x, the Splunk Add-on for Amazon Web Services version 4.6.1 is supported. Do not upgrade to Splunk Add-on for AWS 5.0.0 or above on these versions of the Splunk platform.

New features

Version 5.0.1 of the Splunk Add-on for AWS version contains the following new and changed features:

  • FIPS compliance release for Python 3
  • Improved Support for the Authentication CIM Model.

Fixed issues

Version 5.0.1 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 5.0.1 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

The Splunk Add-on for AWS version 5.x.x is incompatible with Splunk Enterprise versions 7.x.x and earlier.

Third-party software attributions

Version 5.0.1 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 5.0.0

Version 5.0.0 of the Splunk Add-on for Amazon Web Services was released on December 19, 2019.

Compatibility

Version 5.0.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 8.0 and later
CIM 4.3 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, SQS, and SNS.

Version 5.0.0 of the Splunk Add-on for AWS is a Python 3 release and is only compatible with Splunk platform versions 8.0.0 and later. To use version 5.0.0 or later of this add-on, upgrade your Splunk platform deployment to version 8.0.0 or later. For users of Splunk platforms 6.x.x and Splunk 7.x.x, the Splunk Add-on for Amazon Web Services version 4.6.1 is supported. Do not upgrade to Splunk Add-on for AWS 5.0.0 on these versions of the Splunk platform.

New features

Version 5.0.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Support for Python3
  • Python2 is no longer supported, starting in version 5.0.0 of the Splunk Add-on for AWS.

Fixed issues

Version 5.0.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 5.0.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

The Splunk Add-on for AWS version 5.x.x is incompatible with Splunk Enterprise versions 7.x.x and earlier.

Third-party software attributions

Version 5.0.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 4.6.1

Version 4.6.1 of the Splunk Add-on for Amazon Web Services was released on December 10, 2019.

Compatibility

Version 4.6.1 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 6.5 and later
CIM 4.3 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, SQS, and SNS.

New features

Version 4.6.1 of the Splunk Add-on for AWS version contains the following new and changed features:

  • FIPS compliance
  • Updated third party components

Fixed issues

Version 4.6.1 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 4.6.1 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 4.6.1 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 4.6.0

Version 4.6.0 of the Splunk Add-on for Amazon Web Services was released on October 3, 2018.

Compatibility

Version 4.6.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 6.5 and later
CIM 4.3 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, SQS, and SNS.

New features

Version 4.6.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • CloudWatch Metrics input to enable discovery of new entities without Splunk restart
  • Metrics store support (requires a Splunk forwarder version 7.2.0 or above.)
  • Ability to detect configuration of SSL on management port
  • Line/event breaking enforcement for ELB/S3 Access Logs
  • Support for Splunk Enterprise 7.2.0

Fixed issues

Version 4.6.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 4.6.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 4.6.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 4.5.0

Version 4.5.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms.
Splunk platform versions 6.5 and later
CIM 4.3 and later
Supported OS for data collection Platform independent
Vendor products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, SQS, and SNS.

New features

Version 4.5.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Support for the configuration of billing inputs to collect Cost and Usage Report data (sourcetype: aws:billing:cur).

Fixed issues

Version 4.5.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 4.5.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 4.5.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 4.4.0

Version 4.4.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms.
Splunk platform versions 6.5 and later
CIM 4.3 and later
Platforms Platform independent
Vendor Products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, SQS, and SNS.

New features

Version 4.4.0 of the Splunk Add-on for AWS version contains the following new and changed features:

  • Splunk Add-on for AWS 4.4.0 is only compatible with Splunk App for AWS 5.1.0. Previous versions of Splunk App for AWS are not supported.
  • Optimized Web UI for better usability and more streamlined configuration workflow
    • The Create New Input menu has been redesigned with all the menu options organized by the type of data to collect.
    • Two separate configuration pages are now available for Generic S3 and Incremental S3 input types respectively. Previously, the two different input types were configured in one configuration page.
    • Input configuration fields are now grouped into AWS Input Configuration, Splunk-related Configuration, and Advanced Settings sections on the Web UI.
    • Redesigned input configuration UIs for CloudWatch and Config input types let you create multiple inputs all at once.
  • Added a new Temp Folder setting to the Billing input type configuration, which lets you specify a non-default folder for temporarily storing downloaded detailed billing report .zip files when the system default temp folder does not provide sufficient space.
  • You can now configure SQS-based S3 inputs to index non-AWS custom logs in plain text in addition to its supported AWS log types.
  • SQS-based S3 input type now supports CloudTrail and Config SQS notifications.
  • Assume Role is now supported in SQS, Config Rule, and Inspector input types.
  • The Description input type now supports the iam_users service.

Upgrade

To upgrade from versions 4.3 and below, AWS users must be given permission to use the ec2:RunInstances API action, and depending on deployment, the following API actions:

API Action Description
ec2:DescribeImages Allows users to view and select an AMI.
ec2:DescribeVpcs Allows users to view the available EC2-Classic and virtual private clouds (VPCs) network options. This API action is required even if you are not launching into a VPC.
ec2:DescribeSubnets Allows users to view all available subnets for the chosen VPC, when launching into a VPC.
ec2:DescribeSecurityGroups Allows users to view the security groups page in the wizard. Users can select an existing security group.
ec2:DescribeKeyPairs or ec2:CreateKeyPair Allows users to select an existing key pair, or create a new key pair.

See the Configure Description permissions topic in this manual for more information on how to configure AWS permissions.

See the AWS documentation for more information on the DescribeImages function. https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeImages.html.

Fixed issues

Version 4.4.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 4.4.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 4.4.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 4.3.0

Version 4.3.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms.
Splunk platform versions 6.4 and later
CIM 4.3 and later
Platforms Platform independent
Vendor Products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing services, SQS, and SNS.

New features

Version 4.3.0 of the Splunk Add-on for AWS contains the following new and changed features:

  • SQS-based S3 input type A multi-purpose input type that collects several types of logs in response to messages polled from SQS queues. A scalable and higher-performing alternative to the generic S3 and incremental S3 input types. See Multi-purpose input types.
  • Heath Check dashboards Health Overview and S3 Health dashboards to help you troubleshoot data collection errors and performance issues. See Health Check dashboards.
  • Optimized logging. See Internal logs.

Fixed issues

Version 4.3.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 4.3.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 4.3.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 4.2.3

Version 4.2.3 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms.
Splunk platform versions 6.4 and later
CIM 4.3 and later
Platforms Platform independent
Vendor Products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Log, Billing services, SQS, and SNS.

New features

Version 4.2.3 of the Splunk Add-on for AWS does not contain any new features.

Fixed issues

Version 4.2.3 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 4.2.3 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 4.2.3 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 4.2.2

Version 4.2.2 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms.
Splunk platform versions 6.3 and later
CIM 4.3 and later
Platforms Platform independent
Vendor Products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Log, Billing services, SQS, and SNS.

New features

Version 4.2.2 of the Splunk Add-on for AWS does not contain any new features.

Fixed issues

Version 4.2.2 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 4.2.2 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 4.2.2 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 4.2.1

Version 4.2.1 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms.
Splunk platform versions 6.3 and later
CIM 4.3 and later
Platforms Platform independent
Vendor Products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Log, Billing services, SQS, and SNS.

New features

Added support for two new AWS regions: EU (London) and Canada (Central).

Fixed issues

Version 4.2.1 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 4.2.1 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 4.2.1 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 4.2.0

Version 4.2.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms.
Splunk platform versions 6.3 and later
CIM 4.3 and later
Platforms Platform independent
Vendor Products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Log, Billing services, SQS, and SNS.

New features

Version 4.2.0 of the Splunk Add-on for Amazon Web Services supports the AWS Security Token Service (AWS STS) AssumeRole API action that lets you use IAM roles to delegate permissions to IAM users to access these AWS resources. You can configure accounts to use AssumeRole in these data inputs: S3 (general and incremental), Billing, Description, CloudWatch, Kinesis.

Fixed issues

Version 4.2.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 4.2.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 4.2.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 4.1.2

Version 4.1.2 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms.
Splunk platform versions 6.3, 6.4, 6.5
CIM 4.3 or later
Platforms Platform independent
Vendor Products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Log, Billing services, SQS, and SNS.

New features

Version 4.1.2 of the Splunk Add-on for Amazon Web Services contains no new features.

Fixed issues

Version 4.1.2 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Known issues

Version 4.1.2 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 4.1.2 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 4.1.1

Version 4.1.1 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms.
Splunk platform versions 6.3, 6.4 and 6.5
CIM 4.3 or later
Platforms Platform independent
Vendor Products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Log, Billing services, SQS, and SNS.

New features

Version 4.1.1 of the Splunk Add-on for Amazon Web Services contains no new features.

Fixed issues

Version 4.1.1 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Resolved date Issue number Description
2016-10-12 ADDON-11604 Incremental S3 fails to collect data using the IAM role.
2016-09-30 ADDON-11470 The inputs page cannot display more than 30 inputs (S3 as input).
2016-10-11 ADDON-11498, ADDON-11488 Ingesting data from aws:cloudwatchlogs results in invalid JSON format with extraneous trailing angle brackets.
2016-10-04 ADDON-11482 Cloudtrail/SQS fails to collect data using the IAM role.

Known issues

Version 4.1.1 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 4.1.1 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 4.1.0

Version 4.1.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms.
Splunk platform versions 6.3, 6.4
CIM 4.3 or later
Platforms Platform independent
Vendor Products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Log, Billing services, SQS, and SNS.

New features

Version 4.1.0 of the Splunk Add-on for Amazon Web Services has the following new features.

Date Issue number Description
2016-09-22 ADDON-6145 Add AWS SQS modular input for Splunk add-on for AWS.
2016-09-22 ADDON-6146 Add custom alert to AWS SNS for Splunk add-on for AWS.
2016-09-22 ADDON-10952 Performance enhancement for AWS Cloudtrail modular input.
2016-09-22 ADDON-11149 Add Record Format field for AWS Kinesis modular input.
2016-09-22 ADDON-10917 Mapping to ITSI IaaS data module.
2016-09-22 ADDON-10941 Add new incremental data collection for S3 modular input.
2016-09-22 ADDON-10414 Checkpoint and performance enhancement for S3 modular input.
2016-09-22 ADDON-10906 Performance and API call enhancement for Cloudwatch modular input.

Fixed issues

Version 4.1.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Resolved date Issue number Description
2016-09-20 ADDON-11251 There will be data loss of AWS S3 input if the network connection is bad.
2016-09-20 ADDON-11196 If there is a blank space at the beginning or the end of the input name (or both). The input name displays on the UI is not the consistent with the one saved in the configuration file.
2016-09-20 ADDON-11056 In the AWS Region list, it displays ap-northeast-2 instead of Seoul.
2016-09-20 ADDON-10980 Line breaker error for AWS S3 input.
2016-09-14 ADDON-10186 AWS Config fails to fetch S3 object in AWS GovCloud (US) region.
2016-09-09 ADDON-11009 Vanguard: Not getting data from 1 of 3 S3 inputs. This is considered critical for the customer as they have PS on site.
2016-08-18 ADDON-10137 If the number of the AWS input exceeds 30, some of the inputs cannot run successfully.
2016-09-14 ADDON-9778 There are some errors of AWS Kinesis modular input if the request from HEC exceeds its max limit.
2016-09-05 ADDON-9732 Failed to get proxy credentials when password includes # character.
2016-08-28 ADDON-9533 The default Dimension Name is empty square brackets for Autoscaling and EBS namespaces.
2016-08-08 ADDON-9328 CloudWatch data input encounters API rate limit for large metrics.
2016-09-09 ADDON-8758 Mixing log types or gzip with plain text in the same stream causes knowledge extraction to fail for CloudWatch Logs data collected through Kinesis

Known issues

Version 4.1.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 4.1.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 4.0.0

Version 4.0.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms.
Splunk platform versions 6.2.X and later
CIM 4.0 and later
Platforms Platform independent
Vendor Products Amazon Web Services CloudTrail, CloudWatch, CloudWatch Logs, Config, Config Rules, Inspector, Kinesis, S3, VPC Flow Log, and Billing services

Upgrade

If you are upgrading from a previous version of the Splunk Add-on for AWS, be aware of the following changes which may require some actions to preserve the functionality of your existing accounts and inputs:

  • This release includes three new inputs that each require new IAM permissions. Be sure to adjust the IAM permissions of your existing accounts if you want to use them to collect these new data sources.
  • If you are upgrading directly from version 2.0.0 or earlier of this add-on to the 4.0.0 version, you need to open and resave the AWS accounts using the Splunk Add-on for AWS account UI.
  • In this version, the CloudWatch input is rearchitected for better performance and improved stability. One result of this new architecture is that the input has a built in four minute delay after a polling period has ended for any given metric before the actual data collection occurs. This change ensures that there is no data loss due to latency on the AWS side.
  • This version requires a single selection for the Region Category for each AWS account. If you added accounts before region category selection was required, or if you added accounts and selected more than one region category for a single account, the upgrade to version 4.0.0 will put these accounts into an error state until you edit them to select a single region category. On your data collection node, open the add-on and check your Configuration tab to see if any of your existing accounts are missing a region category. If they are, edit the account to add the region category. Any inputs using accounts that were determined to be in error stop collecting data until the account has a region category assigned. Once the account error is resolved, the affected inputs start collecting data again automatically starting from the point when data collection stopped.

New Features

Version 4.0.0 of the Splunk Add-on for Amazon Web Services has the following new features.

Resolved date Issue number Description
2016-04-29 ADDON-7042 CloudWatch input configuration UI now provides auto-filled correct default JSON for metrics and dimensions in each namespace.
2016-04-08 ADDON-7587 Support for AWS Signature V.4 managed keys for S3 related data collection.
2016-04-05 ADDON-7818 New input and CIM mapping for Amazon Inspector data.
2016-04-05 ADDON-7817 New input and CIM mapping for AWS Config rules data.
2016-04-05 ADDON-5391 New input for data from Kinesis streams, including high volume VPC flow log data.
2016-03-31 ADDON-6811 Support for using an EC2 IAM role instead of an AWS account when the add-on’s collection node is on your own managed AWS instance.
2016-03-23 ADDON-7872 Support for the Seoul region.
2016-01-08 ADDON-7311 Support for setting an initial scan time in the Billing input if configuring using the conf files.

Fixed issues

Version 4.0.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Resolved date

Defect number

Description

2016-05-04

ADDON-9169

Monthly Billing is not indexed using the UTC timezone

2016-04-19

ADDON-8801

Billing initial scan time should not use last modified time of S3 key

2016-04-15

ADDON-8721

Sourcetype="aws:cloudwatchlogs:vpcflow" handles src and dest incorrectly

2016-04-11

ADDON-8686

S3 input UI cannot display custom source types when user edits the input.

2016-04-03

ADDON-8547

S3 modular input loses data if new keys are generated during the key listing process

2016-04-02

ADDON-8546

S3 logging is unclear, should include indication of which input stanza is involved.

2016-03-31

ADDON-8548

CloudWatch collection failing with "Failed to get proxy information Empty"

2016-03-15

ADDON-8299

S3 input cannot progress if keys are deleted during the data collection.

2016-02-29

ADDON-8705

Add-on throws "is not JSON serializable" error when calling AWS API for ELB information

2016-02-25

ADDON-7969

CloudWatch has performance problems in large AWS accounts.

2016-02-24

ADDON-7957

Unnecessary tag expansion slows performance.

2016-02-24

ADDON-7926

Default value of max_file_size_csv_zip_in_bytes is too small to handle large detailed billing reports

2016-02-22

ADDON-7897

s3util.py list_cloudwatch_namespaces has performance issue

2016-02-19

ADDON-7877

Upon upgrade from version 2.0.X, S3 inputs experience two problems.
Workaround: 1. Inputs with a S3 key prefix specified stop collecting data from AWS. Workaround: Stop splunkd and go to $SPLUNK_HOME/var/lib/modinputs/aws_s3/, find the checkpoint file for that data input (ls -lh to list and find the large files), open the file, and note the last_modified_time in the file. Remove the checkpoint file and update the data input in inputs.conf using the last_modified_time value that you observed in the checkpoint file for the initial_scan_time in the new input. Reboot splunkd. 2. The polling_interval does not persist automatically. Workaround: In Splunk Web, open the input configuration, go to Settings, set an interval value, then click Update. Or, in local/inputs.conf, set the polling_interval to a value that matches your needs, then save the file.

2016-02-14

ADDON-7777

Not all fields are parsed for CloudFront

2016-02-13

ADDON-7778

Cannot create new input when Splunk does not have a user named "admin"

2016-02-13

ADDON-7776

CloudFront logs should be urldecoded

2016-01-25

ADDON-7573

CloudWatch input requests too many data points in long time windows.

2016-01-18

ADDON-7701

CloudWatch fails to gather data when no metrics appear in a namespace for more than 12 hours.

2015-09-11

ADDON-5498

Unclear error: Unexpected error "<class 'socket.error'>" from python handler: " Connection refused" when user specifies all regions in CloudWatch for one namespace, saves the configuration, and reloads it.

2015-09-10

ADDON-5469

Missing or improper default value for un-required fields.

Known issues

Version 4.0.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Third-party software attributions

Version 4.0.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 3.0.0

Version 3.0.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms.
Splunk platform versions 6.2.X and later
CIM 4.0 and later
Platforms Platform independent
Vendor Products AWS CloudTrail, CloudWatch, CloudWatch Logs, Config, Billing, S3

Upgrade guide

This release includes some changes to the S3 input configuration that break backwards compatibility. If you are upgrading from a previous version and had previously used any of the following parameters, review the new behavior noted here and make any necessary changes in your existing S3 inputs:

  • interval now refers to how long splunkd should wait before checking the health of the modular input and restarting it if it has crashed. The new argument polling_interval, still shown as Interval in the UI, handles the data collection interval. If you had a custom value configured, the 3.0.0 version of the add-on copies your custom setting to the polling_interval value so that your data collection behavior does not change. However, you may wish to tune the interval value to enable splunkd to check for input crashes more frequently.
  • is_secure is deprecated and removed, but the parameter is retained in default/inputs.conf to avoid spec file violations. All traffic is over https. If you have this parameter in your local/inputs.conf, it will have no effect.
  • max_items is deprecated and removed, but the parameter is retained in default/inputs.conf to avoid spec file violations. It is set to 100000 items. If you have this parameter in your local/inputs.conf, it will have no effect.
  • queueSize is deprecated and removed. If you have this parameter in your local/inputs.conf, remove it to avoid potential data loss.
  • persistentQueueSize is deprecated and removed. If you have this parameter in your local/inputs.conf, remove it to avoid potential data loss.
  • recursion_depth is deprecated and removed, but the parameter is retained in default/inputs.conf to avoid spec file violations. The input recursively scans all subdirectories. If you have this parameter in your local/inputs.conf, it will have no effect.
  • ct_excluded_events_index is deprecated and removed, but the parameter is retained in default/inputs.conf to avoid spec file violations. Excluded events will be discarded. If you have this parameter in your local/inputs.conf, it will have no effect.

New features

Version 3.0.0 of the Splunk Add-on for Amazon Web Services has the following new features.

Resolved date Issue number Description
2015-11-16 ADDON-6690 Add-on configuration screen serves a warning message when you access it on a Splunk search head to remind you to configure it on heavy forwarders as a best practice.
2015-12-23 ADDON-6870 Support for GovCloud and China regions in the configuration UI.
2015-12-22 ADDON-6862 Support in the configuration UI and backend for new source types: aws:s3:accesslogs, aws:cloudfront:accesslogs, aws:elb:accesslogs
2015-12-17 ADDON-6190 CloudWatch input refreshes the resource ID list every few hours so as to include additional resources to a wildcarded statement.
2015-12-17 ADDON-6187 CloudWatch collects S3 key count and total size of all keys in buckets.
2015-12-15 ADDON-6864 S3 modular input backend automatically detects the region, thus supporting bucket names with dots in them without user’s needing to specify a region-specific endpoint.
2015-12-15 ADDON-6854 Deprecation of character_set parameter for S3 input. Input supports auto-detection among UTF-8 with/without BOM, UTF-16LE/BE with BOM, UTF-32BE/LE with BOM. Other character sets are not supported.
2015-12-15 ADDON-6189 Support for collecting ELB access logs using the aws:elb:accesslogs.
2015-12-14 ADDON-6869 Support for S3 buckets in the Frankfurt region with V4 signature only.
2016-12-14 ADDON-6866 Improved auditing information for log enrichment.
2015-12-14 ADDON-6859 S3 input blacklist has improved performance.
2015-12-14 ADDON-6857 S3 input whitelist has improved performance.
2015-12-14 ADDON-6860 Improved handling of process failures without duplication or loss of data.
2015-12-14 ADDON-6861 Support for checkpoint deletion behavior for the S3 input to avoid running into collection limits.
2015-12-14 ADDON-6865 Support for initial scan time in the S3 input, as well as in the new aws:s3:accesslogs, aws:cloudfront:accesslogs, and aws:elb:accesslogs source types.
2015-12-14 ADDON-6863 Improved collection behavior in the S3 input: if the key is updated without content changes, the add-on indexes the key again. If the key is changed during data collection, the add-on starts over with the data collection.
2015-12-14 ADDON-6868 The S3 input supports standard server-side KMS encrypted objects.
2015-12-14 ADDON-6855 The S3 input supports bin files.
2015-12-14 ADDON-6852 Improved performance for S3 input. Approximately 300% performance enhancement against 2.0.1 release. Over 8000% performance improvement for small files. See Performance reference for the S3 input in the Splunk Add-on for AWS for details.
2015-12-14 ADDON-6434 UI support for configuring alternate source types within the S3 input.
2015-12-14 ADDON-6196 Support for collecting CloudFront access logs with the aws:cloudfront:accesslogs source type.
2015-12-14 ADDON-6526 S3 input recognizes and skips S3 buckets with contents that have been moved to Glacier.
2015-12-14 ADDON-6188 New source type for S3 access logs: aws:s3:accesslogs.
2015-12-03 ADDON-6433 Improvements to the Description input’s API and interval configuration UI.
2015-12-01 ADDON-6519 Improved timeout behavior in the configuration UI.
2015-11-26 ADDON-6194 Improvements to field aliasing for AWS regions.
2015-11-26 ADDON-6207 Gather metadata through the Description input for EBS, VPC, Security Group, Subnet, Network ACL, Key Pairs, ELB, CloudFront, RDS.

Fixed issues

Version 3.0.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Resolved date

Defect number

Description

2016-01-14

ADDON-7291

S3 data input only shows 30 entries at maximum.

2016-01-03

ADDON-7258

Configuration screen needs to show better error message when user may be trying to use an invalid AWS account.

2015-12-31

ADDON-7253

Default initial_scan_datetime should be ISO8601 instead of the current default of current time minus 7 days.

2015-12-16

ADDON-7031

UI errors when using the base URL via reverse proxy.

2015-12-15

ADDON-6754

Typo in aws_cloudtrail.py script throws critical error in aws_cloudtrail.log with "NameError: global name 'taaw' is not defined".

2015-12-15

ADDON-7008

Add-on is not indexing ELB data through Description input.

2015-12-14

ADDON-6308

S3 input should validate key name does not include invalid characters such as leading or trailing whitespace.

2015-11-26

ADDON-6698

AWS Billing account ID should be payer's account ID instead of linked account ID.

2015-12-22

ADDON-5491

The add-on configuration UI displays all regions instead of those within the selected account's permission scope.

2015-12-20

ADDON-6958 / ADDON-5474

No detailed error shown while getting S3 buckets via REST endpoint with wrong proxy or account settings.

2015-01-22

ADDON-3050/
SPL-96729/
SPL-64904

S3 input is breaking lines incorrectly and inconsistently indexing only partial events due to use of persistentQueueSize.

2014-08-14

ADDON-1827

Checkpoints are not cleared after data inputs are removed or the add-on is uninstalled, thus if you create a new input with the same name as the deleted one, the add-on uses the checkpoint from the old input.

Known issues

Version 3.0.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Date filed

Defect number

Description

2016-05-04

ADDON-9169

Monthly Billing is not indexed by using UTC timezone

2016-04-28

ADDON-9145

Error message shown on input creation screen has logic issues and is not as specific as we could be

2016-04-19

ADDON-8801

Billing initial scan time should not use last modified time of S3 key

2016-04-15

ADDON-8721

Sourcetype="aws:cloudwatchlogs:vpcflow" handles src and dest incorrectly

2016-04-11

ADDON-8686

S3 input UI cannot display custom source types when user edits the input.

2016-04-03

ADDON-8547

S3 modular input loses data if new keys are generated during the key listing process

2016-04-02

ADDON-8546

S3 logging is unclear, should include indication of which input stanza is involved.

2016-03-31

ADDON-8548

Cloudwatch Collection failing with Failed to get proxy information Empty

2016-03-15

ADDON-8299

S3 input cannot progress if keys are deleted during the data collection.

2016-02-29

ADDON-8705

Add-on throws "is not JSON serializable" error when calling AWS API for ELB information

2016-02-25

ADDON-7969

CloudWatch has performance problems in large AWS accounts.

2016-02-24

ADDON-7957

Unnecessary tag expansion slows performance.

2016-02-24

ADDON-7926

Default value of max_file_size_csv_zip_in_bytes is too small to handle large detailed billing reports

2016-02-22

ADDON-7897

s3util.py list_cloudwatch_namespaces has performance issue

2016-02-19

ADDON-7877

Upon upgrade from version 2.0.X, S3 inputs experience two problems.
Workaround: 1. Inputs with a S3 key prefix specified stop collecting data from AWS. Workaround: Stop splunkd and go to $SPLUNK_HOME/var/lib/modinputs/aws_s3/, find the checkpoint file for that data input (ls -lh to list and find the large files), open the file, and note the last_modified_time in the file. Remove the checkpoint file and update the data input in inputs.conf using the last_modified_time value that you observed in the checkpoint file for the initial_scan_time in the new input. Reboot splunkd. 2. The polling_interval does not persist automatically. Workaround: In Splunk Web, open the input configuration, go to Settings, set an interval value, then click Update. Or, in local/inputs.conf, set the polling_interval to a value that matches your needs, then save the file.

2016-02-14

ADDON-7777

Not all fields are parsed for CloudFront

2016-02-13

ADDON-7778

Cannot create new input when Splunk does not have a user named "admin"

2016-02-13

ADDON-7776

CloudFront logs should be urldecoded

2016-02-11

ADDON-7764

FIPS mode is not supported by this add-on.

2016-01-25

ADDON-7573

CloudWatch input requests too many data points in long time windows.

2016-01-18

ADDON-7701

CloudWatch fails to gather data when no metrics appear in a namespace for more than 12 hours.

2016-01-13

ADDON-7448

In the Description data input, the port range defaults to null in vpc_network_acls if no range is specified, which is confusing, because it actually has a range of "all".

2015-12-29

ADDON-7239

Using "/" in data input name causes exceptions. UI does not accept this character in the input names, but if you configure your input using conf files, you will find exceptions in logs.

2015-12-22

ADDON-7160

Add-on throws a timeout error in the UI when user attempts to create a new S3 input, but successfully creates the input in the backend, causing errors if the user tries to create the same input again.

2015-12-22

ADDON-7159

After removing all search peers, add-on still shows performance warnings.
Workaround: Restart a Splunk platform instance after changing its role.

2015-12-21

ADDON-7077

Infrequent Access storage type not supported

2015-12-16

ADDON-7035

Add-on ingests the header line of the CloudFront access log, but it should be skipped.

2015-11-26

ADDON-6701

EC2, RDS, ELB, and EC2 APIs do not consider pagination.

2015-10-14

ADDON-6056

S3 logging errors on Windows.

2015-10-13

ADDON-6043

SQS message mistakenly deleted when the add-on throws an error retrieving data from an S3 bucket.

2015-09-11

ADDON-5500

Preconfigured reports for billing data cannot handle reports that have a mix of different currencies. The report will use the first currency found and apply that to all costs.

2015-09-11

ADDON-5499

CloudWatch: Previous selected Metric namespace always exists in the list regardless of the region change

2015-09-11

ADDON-5498

Unclear error: Unexpected error "<class 'socket.error'>" from python handler: " Connection refused" when user specifies all regions in CloudWatch for one namespace, saves the configuration, and reloads it.

2015-09-10

ADDON-5481

The add-on configuration UI does not handle insufficient Splunk user permissions gracefully.

2015-09-10

ADDON-5471

Deleting a CloudWatch data input takes too long.

2015-09-10

ADDON-5469

Missing or improper default value for un-required fields.

2015-09-07

ADDON-5355

Different error message for same error when creating duplicated data inputs.

2015-09-06

ADDON-5354

Using keyboard to delete selections from configuration dropdown multi-select field causes drop-down list to appear in corner of screen.

2015-09-01

ADDON-5309

UI default value is not read from default input config file

2015-09-01

ADDON-5295

Description inconsistent in the GUI for CloudTrail service and CloudTrail from S3 service blacklist behavior.

2015-08-31

ADDON-5212

Chrome highlights "misspelling" of configuration text in the GUI.

2015-07-06

ADDON-6177

When tmp file system runs out of space, aws_billing.py fails with IOError: No space left on device.

2015-04-02

ADDON-3578

S3: uppercase bucket names cause an error

2015-03-25

ADDON-3460

On OSs (like Debian and Ubuntu) that use dash for shell scripts, aws_cloudwatch.py spawns zombie processes.
Workaround: Kill the processes and restart. Use bash to prevent re-occurrence.

2014-09-28

ADDON-2135

The list of regions shown in inputs configuration in Splunk Web shows all Amazon regions regardless of the permissions associated with the selected AWS account.

2014-09-26

ADDON-2118

Data inputs continue to work after user deletes the account used for that input.
Workaround: Restart the Splunk platform after deleting or modifying an AWS account.

2014-09-25

ADDON-2113

The app.conf file includes a stanza for a proxy server configuration with a hashed password even if the user has not configured a proxy or password.
Workaround: This behavior is expected because Splunk Enterprise automatically sets the proxy field to 0 and saves an encrypted entry in app.conf.

2014-09-16

ADDON-2029

In saved search "Monthly Cost till *" _time is displayed per day rather than per month.

Third-party software attributions

Version 3.0.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 2.0.1

Version 2.0.1 of the Splunk Add-on for Amazon Web Services has the same compatibility specifications as version 3.0.0.

Fixed issues

Version 2.0.1 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Resolved date Defect number Description
2015-11-04 ADDON-5813 S3 input cannot handle bucket names with “.” in them. See “Add an S3 input for the Splunk Add-on for AWS” for details of the solution.
2015-10-28 ADDON-6125 Add-on makes too many unnecessary get_log_event API calls, causing inefficiencies in environments with many spot instances.
2015-10-26 ADDON-5785 Corrupt VPC Flow checkpointer file in race condition.
2015-10-20 ADDON-5612 When CloudTrail userName is null, add-on coalesces the userName to “root” instead of “unknown”.
2015-10-15 ADDON-6004 Add-on GUI does not allow user to select an index that is only defined on the indexers.
2015-10-11 ADDON-6003 Incorrect regions shown in region drop-down list.
2015-10-11 ADDON-6001 Config fails to fetch events from an S3 bucket in a different region.
2015-10-09 ADDON-5833 AWS CloudWatch log formatting exception.
2015-10-09 ADDON-4505 Cloudwatchlog deadlocks due to throttling exceptions when an input task includes a large number of log groups.
2015-10-09 ADDON-5782 A corrupted checkpointer file for VPC Flow blocks other logstreams.

Known issues

Version 2.0.1 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Date filed

Defect number

Description

2015-12-15

ADDON-7930

Data collection for Cloudwatch S3 metrics does not support wildcard in BucketName or array length > 1.

2015-11-09

ADDON-6371

In some cases, Splunk Cloud does not save the AWS account credentials after they are correctly entered. Workaround: File a support request to redeploy the add-on and restart the instance.

2015-10-14

ADDON-6056

S3 logging errors on Windows.

2015-10-13

ADDON-6043

SQS message mistakenly deleted when the add-on throws an error retrieving data from an S3 bucket.

2015-09-11

ADDON-5500

Preconfigured reports for billing data cannot handle reports that have a mix of different currencies. The report will use the first currency found and apply that to all costs.

2015-09-11

ADDON-5499

CloudWatch: Previous selected Metric namespace always exists in the list regardless of the region change.

2015-09-11

ADDON-5498

Unclear error message: Failed to load options for Metric namespace. Detailed Error: Unexpected error "<class 'socket.error'>" from python handler: "[Errno 111] Connection refused" when user specifies all regions in CloudWatch for one namespace, saves the configuration, and reloads it.

2015-09-10

ADDON-5481

The add-on configuration UI does not handle insufficient Splunk user permissions gracefully.

2015-09-10

ADDON-5474

No detailed error shown while getting S3 buckets via REST endpoint with wrong proxy or account settings.

2015-09-10

ADDON-5471

Deleting a CloudWatch data input takes too long.

2015-09-10

ADDON-5469

Missing or improper default value for un-required fields.

2015-09-10

ADDON-5491

The add-on configuration UI displays all regions instead of those within the selected account's permission scope.

2015-09-07

ADDON-5355

Different error message for same error when creating duplicated data inputs.

2015-09-06

ADDON-5354

Using keyboard to delete selections from configuration dropdown multi-select field causes drop-down list to appear in corner of screen.

2015-09-01

ADDON-5309

UI default value is not read from default input config file.

2015-09-01

ADDON-5295

Description inconsistent in the GUI for CloudTrail service and CloudTrail from S3 service blacklist behavior.

2015-08-31

ADDON-5212

Chrome highlights "misspelling" of configuration text in the GUI.

2015-07-09

ADDON-3460 /
CO-4749 /
SPL-55904

On OSs (like Debian and Ubuntu) that use dash for shell scripts, aws_cloudwatch.py spawns zombie processes. Workaround: Kill the processes and restart. Use bash to prevent re-occurrence.

2015-07-06

ADDON-6177

aws_billing.py fails with IOError: [Errno 28] No space left on device.

2015-04-03

ADDON-3578

Uppercase bucket name causes errors.

2015-01-22

ADDON-3050/
SPL-96729/
SPL-64904

S3 input is breaking lines incorrectly and inconsistently indexing only partial events.
Workaround: Disable the persistent queue for the S3 input by changing persistentQueueSize = 24MB to persistentQueueSize = 0 in local/inputs.conf.

2015-01-25

ADDON-3070

The add-on does not index the Configuration.State.Code change from SQS that is reported to users on the AWS Config UI. Splunk Enterprise only indexes configuration snapshots from S3 as new events, and only after a "ConfigurationHistoryDeliveryCompleted" notification is recieved by SQS.

2014-09-26

ADDON-2118

Data inputs continue to work after user deletes the account used for that input. Workaround: Restart Splunk Enterprise after deleting or modifying an AWS account.

2014-09-28

ADDON-2135

The list of regions shown in inputs configuration in Splunk Web shows all Amazon regions regardless of the permissions associated with the selected AWS account.

2014-09-26

ADDON-2116/
SPL-91709

On Windows 2012, Splunk Web shows a timeout error when a user attempts to add or delete an AWS account on the setup page. Workaround: Refresh the page.

2014-09-25

ADDON-2113

The app.conf file includes a stanza for a proxy server configuration with a hashed password even if the user has not configured a proxy or password. This behavior is expected because Splunk Enterprise automatically sets the proxy field to 0 and saves an encrypted entry in app.conf.

2014-09-16

ADDON-2029

In saved search "Monthly Cost till *" _time is displayed per day rather than per month.

2014-09-09

ADDON-1983 /
ADDON-1938 /
SPL-81771

Errors can occur in checkpointing if modular input stdout is prematurely closed during termination. Checkpoint and retry time do not log correctly when Splunkd stops.

2014-08-26

ADDON-1919

If a user changes the configuration to use a different AWS account, Splunk Web continues to list buckets for the previously configured account.

2014-08/17

ADDON-1854

After initial configuration, adjusting Max trackable items might cause data loss.

2014-08-14

ADDON-1827

Checkpoints are not cleared after data inputs are removed or the add-on is uninstalled, thus if you create a new input with the same name as the deleted one, the add-on uses the checkpoint from the old input. Workaround: create unique input names to avoid picking up old checkpoint files.

Third-party software attributions

Version 2.0.1 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 2.0.0

Version 2.0.0 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms.
Splunk platform versions 6.3, 6.2
CIM 4.0 and above
Platforms Platform independent
Vendor Products AWS CloudTrail, CloudWatch, CloudWatch Logs, Config, Billing, S3

New features

Version 2.0.0 of the Splunk Add-on for Amazon Web Services has the following new features.

Resolved date Defect number Description
2015-09-08 ADDON-1671 New configuration UI.
2015-09-08 ADDON-2126 / ADDON-5466 Ability to manually enter S3 bucket names, SQS queue names, and metric namespaces in Splunk Web fields, in case connection to AWS is poor or user account lacks permissions to list buckets.
2015-07-14 ADDON-4543 Added unified field for AWS account ID across all data inputs: aws_account_id.
2015-07-06 ADDON-3189 Currency field added to AWS billing report data, allowing users to more accurately judge financial impact.
2015-07-03 ADDON-4260 / ADDON-1665 Support for data ingestion from AWS CloudWatch Logs service, including VPC Flow Logs.
2015-07-03 ADDON-4259 CIM mapping for VPC Flow Logs data.
2015-06-30 ADDON-4158 Support for Config snapshot collection.
2015-06-29 ADDON-2364 Support for collecting archives of CloudTrail data via S3 buckets by configuring the sourcetype aws:cloudtrail in an S3 input.
2015-06-29 ADDON-4413 Support for multiple regions in a single CloudWatch input.
2015-06-29 ADDON-3235 Support for disabling SSL proxies using the is_secure parameter in local/aws_global_settings.conf to alter the behavior of connections to AWS.
2015-06-29 ADDON-4180 Support for inventory metadata collection from AWS.

Fixed issues

Version 2.0.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.

Resolved date Defect number Description
2015-09-14 ADDON-5158 CloudTrail data missing some CIM tagging.
2015-08-31 ADDON-5200 CloudWatch input calls AWS API inefficiently, using separate API call for each instance-metric combination.
2015-08-31 ADDON-2006 Unfriendly error message when user specifies invalid account.
2015-08-31 ADDON-1932 Unfriendly error message when configuring proxy incorrectly.
2015-08-31 ADDON-1926 Splunk Web allows you to update and delete an AWS account for the add-on simultaneously.
2015-09-09 ADDON-4822 / CO-4912 Some instances of Splunk Cloud show blank screens for all data input pages. Workaround: Set up a heavy forwarder on-prem to handle data inputs and forward the data to Splunk Cloud.

Known issues

Version 2.0.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Date filed

Defect number

Description

2015-10-14

ADDON-6056

S3 logging errors on Windows.

2015-10-13

ADDON-6043

SQS message mistakenly deleted when the add-on throws an error retrieving data from an S3 bucket.

2015-10-09

ADDON-6004

Add-on GUI does not allow user to select an index that is only defined on the indexers.

2015-10-09

ADDON-6003

Incorrect regions shown in region drop-down list.

2015-10-09

ADDON-6001

Confg fails to fetch events from an S3 bucket in a different region.

2015-10-03

ADDON-5833

AWS CloudWatch log formatting exception.

2015-09-28

ADDON-5813

S3 input cannot handle bucket names with "." in them.

2015-09-24

ADDON-5785

Corrupt VPC Flow checkpointer file in race condition.

2015-09-24

ADDON-5782

A corrupted checkpointer file for VPC Flow blocks other logstreams.

2015-09-17

ADDON-5612

When CloudTrail userName is null, add-on coalesces the userName to "root" instead of "unknown".

2015-09-11

ADDON-5500

Preconfigured reports for billing data cannot handle reports that have a mix of different currencies. The report will use the first currency found and apply that to all costs.

2015-09-11

ADDON-5499

CloudWatch: Previous selected Metric namespace always exists in the list regardless of the region change.

2015-09-11

ADDON-5498

Unclear error message: Failed to load options for Metric namespace. Detailed Error: Unexpected error "<class 'socket.error'>" from python handler: "[Errno 111] Connection refused" when user specifies all regions in CloudWatch for one namespace, saves the configuration, and reloads it.

2015-09-10

ADDON-5481

The add-on configuration UI does not handle insufficient Splunk user permissions gracefully.

2015-09-10

ADDON-5491

The add-on configuration UI displays all regions instead of those within the selected account's permission scope.

2015-09-10

ADDON-5474

No detailed error shown while getting S3 buckets via REST endpoint with wrong proxy or account settings.

2015-09-10

ADDON-5471

Deleting a CloudWatch data input takes too long.

2015-09-10

ADDON-5469

Missing or improper default value for un-required fields.

2015-09-07

ADDON-5355

Different error message for same error when creating duplicated data inputs.

2015-09-06

ADDON-5354

Using keyboard to delete selections from configuration dropdown multi-select field causes drop-down list to appear in corner of screen.

2015-09-01

ADDON-5309

UI default value is not read from default input config file.

2015-09-01

ADDON-5295

Description inconsistent in the GUI for CloudTrail service and CloudTrail from S3 service blacklist behavior.

2015-08-31

ADDON-5212

Chrome highlights "misspelling" of configuration text in the GUI.

2015-07-10

ADDON-4505

Cloudwatchlog deadlocks due to throttling exceptions when an input task includes a large number of log groups.

2015-07-09

ADDON-3460 / CO-4749 / SPL-55904

On OSs (like Debian and Ubuntu) that use dash for shell scripts, aws_cloudwatch.py spawns zombie processes. Workaround: Kill the processes and restart. Use bash to prevent re-occurrence.

2015-07-06

ADDON-6177

aws_billing.py fails with IOError: [Errno 28] No space left on device.

2015-04-03

ADDON-3578

Uppercase bucket name causes errors.

2015-01-22

ADDON-3050/
SPL-96729/
SPL-64904

S3 input is breaking lines incorrectly and inconsistently indexing only partial events.
Workaround: Disable the persistent queue for the S3 input by changing persistentQueueSize = 24MB to persistentQueueSize = 0 in local/inputs.conf.

2015-01-25

ADDON-3070

The add-on does not index the Configuration.State.Code change from SQS that is reported to users on the AWS Config UI. Splunk Enterprise only indexes configuration snapshots from S3 as new events, and only after a "ConfigurationHistoryDeliveryCompleted" notification is recieved by SQS.

2014-09-26

ADDON-2118

Data inputs continue to work after user deletes the account used for that input. Workaround: Restart Splunk Enterprise after deleting or modifying an AWS account.

2014-09-28

ADDON-2135

The list of regions shown in inputs configuration in Splunk Web shows all Amazon regions regardless of the permissions associated with the selected AWS account.

2014-09-26

ADDON-2116/
SPL-91709

On Windows 2012, Splunk Web shows a timeout error when a user attempts to add or delete an AWS account on the setup page. Workaround: Refresh the page.

2014-09-25

ADDON-2113

The app.conf file includes a stanza for a proxy server configuration with a hashed password even if the user has not configured a proxy or password. This behavior is expected because Splunk Enterprise automatically sets the proxy field to 0 and saves an encrypted entry in app.conf.

2014-09-16

ADDON-2029

In saved search "Monthly Cost till *" _time is displayed per day rather than per month.

2014-09-09

ADDON-1983 / ADDON-1938 / SPL-81771

Errors can occur in checkpointing if modular input stdout is prematurely closed during termination. Checkpoint and retry time do not log correctly when Splunkd stops.

2014-08-26

ADDON-1919

If a user changes the configuration to use a different AWS account, Splunk Web continues to list buckets for the previously configured account.

2014-08/17

ADDON-1854

After initial configuration, adjusting Max trackable items might cause data loss.

2014-08-14

ADDON-1827

Checkpoints are not cleared after data inputs are removed or the add-on is uninstalled, thus if you create a new input with the same name as the deleted one, the add-on uses the checkpoint from the old input. Workaround: create unique input names to avoid picking up old checkpoint files.

Third-party software attributions

Version 2.0.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries.

Version 1.1.1

Version 1.1.1 of the Splunk Add-on for Amazon Web Services is compatible with the following software, CIM versions, and platforms.
Splunk Enterprise versions 6.2, 6.1
CIM 4.2, 4.1, 4.0
Platforms Platform independent
Vendor Products AWS Billing, CloudTrail, CloudWatch, Config, S3

Fixed issues

Version 1.1.1 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.
Resolved date Defect number Description
04/24/15 ADDON-3512 Timeout error on new account definition. Users can now set splunkdConnectionTimeout = 3000 in $SPLUNK_HOME/etc/system/local/web.conf to avoid setup timeout problems.
04/21/15 ADDON-3612 Add-on cannot parse multi-account message format from SQS and CloudTrail.
04/21/15 ADDON-3577 Input configuration timeout on retrieving bucket/key list from S3.
03/01/15 ADDON-3119 Add-on fails to collect payloads from GovCloud region.

Known issues

Version 1.1.1 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

Date

Defect number

Description

08/27/15

ADDON-5158

CloudTrail data missing some CIM tagging.

08/06/15

ADDON-4822 / CO-4581

Some instances of Splunk Cloud show blank screens for all data input pages. Workaround: Set up a heavy forwarder on-prem to handle data inputs and forward the data to Splunk Cloud.

04/10/15

ADDON-3652

Billing reports are not performant.

04/03/15

ADDON-3578

Uppercase bucket name causes errors.

01/22/15

ADDON-3050/
SPL-96729/
SPL-64904

S3 input is breaking lines incorrectly and inconsistently indexing only partial events.
Workaround: Disable the persistent queue for the S3 input by changing persistentQueueSize = 24MB to persistentQueueSize = 0 in local/inputs.conf.

01/25/15

ADDON-3070

The add-on does not index the Configuration.State.Code change from SQS that is reported to users on the AWS Config UI. Splunk Enterprise only indexes configuration snapshots from S3 as new events, and only after a "ConfigurationHistoryDeliveryCompleted" notification is recieved by SQS.

01/06/15

ADDON-2910

Splunk Cloud customers cannot access props.conf to configure line breaking on S3 events.

10/10/14

ADDON-2154

Billing input data has a non-ISO-8601 timestamp appended to the source field of each event. Workaround: Add a new field named "source2" in the suggested format: ..... | rex field=source "(?s3://[^:])" | rex field=source "(?(csv|zip):.$)" | eval source2=strftime(strptime(substr(source_date, 9),"%d %b %Y %H:%M:%S"),"%Y-%m-%dT%H:%M:%S%z") | eval source2=source_file+":"+source2.

09/26/14

ADDON-2118

Data inputs continue to work after user deletes the account used for that input. Workaround: Restart Splunk Enterprise after deleting or modifying an AWS account.

09/28/14

ADDON-2135

The list of regions shown in inputs configuration in Splunk Web shows all Amazon regions regardless of the permissions associated with the selected AWS account.

09/26/14

ADDON-2116/
SPL-86716

On Windows 2012, Splunk Web shows a timeout error when a user attempts to add or delete an AWS account on the setup page. Workaround: Refresh the page.

09/26/14

ADDON-2115

If user does not provide a friendly name when configuring an AWS account in the setup screen, account is not configured but no error message appears

09/25/14

ADDON-2113

The app.conf file includes a stanza for a proxy server configuration with a hashed password even if the user has not configured a proxy or password. This behavior is expected because Splunk Enterprise automatically sets the proxy field to 0 and saves an encrypted entry in app.conf.

09/25/14

ADDON-2110

In Splunk 6.2, when network is unstable, some input configuration fields fail to display in Splunk Web and no error message is shown.

09/16/14

ADDON-2029

In saved search "Monthly Cost till *" _time is displayed per day rather than per month.

09/11/14

ADDON-2006

Unfriendly error message when user specifies invalid account.

09/09/14

ADDON-1983

If Splunk Enterprise restarts while indexing S3 data, data duplication might occur. Workaround: Use AWS command line tools.

08/28/14

ADDON-1938

Checkpoint and retry time do not log correctly when Splunkd stops.

08/28/14

ADDON-1932

Unfriendly error message when configuring proxy incorrectly.

08/26/14

ADDON-1926

Splunk Web allows you to update and delete an AWS account for the add-on simultaneously.

08/26/14

ADDON-1919

If a user changes the configuration to use a different AWS account, Splunk Web continues to list buckets for the previously configured account.

08/24/14

ADDON-1895

If user tries to update a billing report manually using Microsoft Excel, the add-on cannot process the modified file and throws "failed to parse key" error.

08/21/14

ADDON-1885

Splunk Enterprise does not validate Amazon Web Services credentials during add-on setup.

08/17/14

ADDON-1854

After initial configuration, adjusting Max trackable items might cause data loss.

08/14/14

ADDON-1827

Checkpoints are not cleared after data inputs are removed or the add-on is uninstalled, thus if you create a new input with the same name as the deleted one, the add-on uses the checkpoint from the old input. Workaround: create unique input names to avoid picking up old checkpoint files.

03/12/14

SPL-81771

Errors can occur in checkpointing if modular input stdout is prematurely closed during termination.

Third-party software attributions

Version 1.1.1 of the Splunk Add-on for Amazon Web Services incorporates boto - AWS for Python.

Version 1.1.0

Version 1.1.0 had the same compatibility specifications as Version 1.1.1.

New features

Version 1.1.0 of the Splunk Add-on for Amazon Web Services has the following new features.
Date Issue number Description
02/12/15 ADDON-3148 Support for the SNS Subscription attributes for Raw Message Delivery for AWS Config and CloudTrail.
02/09/15 ADDON-1644 Pre-built panels for CloudWatch, CloudTrail, and Billing data.
12/18/14 ADDON-2678 Allow users to configure the log level.
11/12/14 ADDON-2202 New modular input for AWS Config data.

Fixed issues

Version 1.1.0 of the Splunk Add-on for Amazon Web Services fixes the following, if any, issues.
Resolved date Defect number Description
02/11/15 ADDON-2533 Internal logs are source typed as “this-too-small”.
02/10/15 ADDON-2679 Process for fetching logs runs in a loop.
02/09/15 ADDON-3154 Support AssumedRole user name for CloudTrail.

Known issues

Version 1.1.0 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.
Date Defect number Description
01/22/15 ADDON-3050 S3 input is breaking lines incorrectly.
01/25/15 ADDON-3070 The add-on does not index the Configuration.State.Code change from SQS that is reported to users on the AWS Config UI. Splunk Enterprise only indexes configuration snapshots from S3 as new events, and only after a “ConfigurationHistoryDeliveryCompleted” notification is recieved by SQS.
01/06/15 ADDON-2910 Splunk Cloud customers cannot access props.conf to configure line breaking on S3 events.
09/28/14 ADDON-2135 The list of regions shown in inputs configuration in Splunk Web shows all Amazon regions regardless of the permissions associated with the selected AWS account.
09/26/14 ADDON-2116 On Windows 2012, Splunk Web shows a timeout error when a user attempts to add or delete an AWS account on the setup page. Workaround: Refresh the page.
09/26/14 ADDON-2115 If user does not provide a friendly name when configuring an AWS account in the setup screen, account is not configured but no error message appears
09/25/14 ADDON-2113 The app.conf file includes a stanza for a proxy server configuration with a hashed password even if the user has not configured a proxy or password. This behavior is expected because Splunk Enterprise automatically sets the proxy field to 0 and saves an encrypted entry in app.conf.
09/25/14 ADDON-2110 In Splunk 6.2, when network is unstable, some input configuration fields fail to display in Splunk Web and no error message is shown.
09/16/14 ADDON-2029 In saved search “Monthly Cost till *” _time is displayed per day rather than per month.
09/11/14 ADDON-2006 Unfriendly error message when user specifies invalid account.
09/09/14 ADDON-1983 If Splunk Enterprise restarts while indexing S3 data, data duplication might occur. Workaround: Use AWS command line tools.
08/28/14 ADDON-1938 Checkpoint and retry time do not log correctly when Splunkd stops.
08/28/14 ADDON-1932 Unfriendly error message when configuring proxy incorrectly.
08/26/14 ADDON-1926 Splunk Web allows you to update and delete an AWS account for the add-on simultaneously.
08/26/14 ADDON-1919 If a user changes the configuration to use a different AWS account, Splunk Web continues to list buckets for the previously configured account.
08/24/14 ADDON-1895 If user tries to update a billing report manually using Microsoft Excel, the add-on cannot process the modified file and throws “failed to parse key” error.
08/21/14 ADDON-1885 Splunk Enterprise does not validate Amazon Web Services credentials during add-on setup.
08/17/14 ADDON-1854 After initial configuration, adjusting Max trackable items might cause data loss.
08/14/14 ADDON-1827 Checkpoints are not cleared after data inputs are removed or the add-on is uninstalled, thus if you create a new input with the same name as the deleted one, the add-on uses the checkpoint from the old input. Workaround: create unique input names to avoid picking up old checkpoint files.
03/12/14 SPL-81771 Errors can occur in checkpointing if modular input stdout is prematurely closed during termination.

Third-party software attributions

Version 1.1.0 of the Splunk Add-on for Amazon Web Services incorporates boto - AWS for Python.

Version 1.0.1

Version 1.0.1 of the Splunk Add-on for Amazon Web Services was compatible with the following software, CIM versions, and platforms.
Splunk Enterprise versions 6.2, 6.1
CIM 4.1, 4.0, 3.0
Platforms Platform independent
Vendor Products AWS Billing, CloudTrail, CloudWatch, S3

Fixed issues

Version 1.0.1 of the Splunk Add-on for Amazon Web Services fixed the following issues.
Resolved date Defect number Description
12/16/14 ADDON-2530 New version of boto library required to support eu-central-1 region.
12/11/14 ADDON-2359 Unexpected SQS messages can block inputs.

Known issues

Version 1.0.1 of the Splunk Add-on for Amazon Web Services has the following, if any, known issues.

  • Internal log files are incorrectly sourcetyped as N-too-small. (ADDON-2533)
  • Errors can occur in checkpointing if modular input stdout is prematurely closed during termination. (SPL-81771)
  • After initial configuration, adjusting Max trackable items might cause data loss. (ADDON-1854)
  • Splunk Enterprise does not validate Amazon Web Services credentials during add-on setup. (ADDON-1885)
  • If user tries to update a billing report manually using Microsoft Excel, the add-on cannot process the modified file and throws “failed to parse key” error. (ADDON-1895)
  • If a user changes the configuration to use a different AWS account, Splunk Web continues to list buckets for the previously configured account. (ADDON-1919)
  • Splunk Web allows you to update and delete an AWS account for the add-on simultaneously. (ADDON-1926)
  • Setup and configuration pages in Splunk Web give unfriendly error messages when given invalid inputs (ADDON-1932, ADDON-2006)
  • If Splunk Enterprise restarts while indexing S3 data, data duplication might occur. Workaround: Use AWS command line tools. (ADDON-1983 and ADDON-1938)
  • In saved search “Monthly Cost till *” _time is displayed per day rather than per month. (ADDON-2029)
  • The app.conf file includes a stanza for a proxy server configuration with a hashed password even if the user has not configured a proxy or password. This behavior is expected because Splunk Enterprise automatically sets the proxy field to 0 and saves an encrypted entry in app.conf. (ADDON-2113)
  • If user does not provide a friendly name when configuring an AWS account in the setup screen, account is not configured but no error message appears (ADDON-2115)
  • On Windows 2012, Splunk Web shows a timeout error when a user attempts to add or delete an AWS account on the setup page. Workaround: Refresh the page. (ADDON-2116)
  • The list of regions shown in inputs configuration in Splunk Web shows all Amazon regions regardless of the permissions associated with the selected AWS account. (ADDON-2135)
  • In Splunk 6.2, when network is unstable, some input configuration fields fail to display in Splunk Web and no error message is shown. (ADDON-2110)

Third-party software attributions

Version 1.0.1 of the Splunk Add-on for Amazon Web Services incorporated boto - AWS for Python.

Version 1.0.0

Version 1.0.0 of the Splunk Add-on for Amazon Web Services had the same compatibility specifications as version 1.0.1.

Known issues

Version 1.0.0 of the Splunk Add-on for Amazon Web Services had the following known issues:

  • Errors can occur in checkpointing if modular input stdout is prematurely closed during termination. (SPL-81771)
  • After initial configuration, adjusting Max trackable items might cause data loss. (ADDON-1854)
  • Splunk Enterprise does not validate Amazon Web Services credentials during add-on setup. (ADDON-1885)
  • If user tries to update a billing report manually using Microsoft Excel, the add-on cannot process the modified file and throws “failed to parse key” error. (ADDON-1895)
  • If a user changes the configuration to use a different AWS account, Splunk Web continues to list buckets for the previously configured account. (ADDON-1919)
  • Splunk Web allows you to update and delete an AWS account for the add-on simultaneously. (ADDON-1926)
  • Setup and configuration pages in Splunk Web give unfriendly error messages when given invalid inputs (ADDON-1932, ADDON-2006)
  • If Splunk Enterprise restarts while indexing S3 data, data duplication might occur. Workaround: Use AWS command line tools. (ADDON-1983 and ADDON-1938)
  • In saved search “Monthly Cost till *” _time is displayed per day rather than per month. (ADDON-2029)
  • The app.conf file includes a stanza for a proxy server configuration with a hashed password even if the user has not configured a proxy or password. This behavior is expected because Splunk Enterprise automatically sets the proxy field to 0 and saves an encrypted entry in app.conf. (ADDON-2113)
  • If user does not provide a friendly name when configuring an AWS account in the setup screen, account is not configured but no error message appears (ADDON-2115)
  • On Windows 2012, Splunk Web shows a timeout error when a user attempts to add or delete an AWS account on the setup page. Workaround: Refresh the page. (ADDON-2116)
  • The list of regions shown in inputs configuration in Splunk Web shows all Amazon regions regardless of the permissions associated with the selected AWS account. (ADDON-2135)
  • In Splunk 6.2, when network is unstable, some input configuration fields fail to display in Splunk Web and no error message is shown. (ADDON-2110)

Third-party software attributions

Version 1.0.0 of the Splunk Add-on for Amazon Web Services incorporated boto - AWS for Python.