Configuration - Search for AWS

Most of Search for AWS is configured on the Accounts tab of the Setup page. The settings on this page are the rest: runtime values you rarely need to touch, but that are there when you want to change the default region, tune fan-out concurrency or request timeouts, adjust the response cache, or raise the log level. All but three are on the Setup page’s Settings and Cache tabs - the cache directory and use_splunkd_proxy are set in the file only, and the log file’s name in the file or through the app’s settings REST endpoint - and all of them live in aws_search.conf.

A field left blank keeps the shipped default. A change is picked up by the next search - no restart. On Splunk Cloud the tabs are the only way to set these values; on a self-managed search head you can also edit the file:

$SPLUNK_HOME/etc/apps/os_aws_search/local/aws_search.conf

An app upgrade overwrites default/, so a value set there is lost on the next release; local/ always wins and survives upgrades, and the Setup page writes local/ for you. The bundled README/aws_search.conf.spec is the exhaustive schema.

AWS requests

The Settings tab, and [aws] in the file.

Setting	Default	What it does
`default_region`	`us-east-1`	Used when an account has no default region of its own and the search sets no `region=`.
`fan_out_concurrency`	`8`	How many account and region pairs one search queries at once during a fan-out (ceiling 64). A search’s `concurrency=` argument overrides it.
`request_timeout`	`30s`	Caps one AWS API request, not the whole search. An async command such as `awsathena` or `awslogs` makes many bounded requests over its life.
`use_splunkd_proxy`	`true`	File only. AWS calls go through the proxy Splunk is configured with - the `[proxyConfig]` stanza of `server.conf`, honoring its `proxy_rules` and `no_proxy` - including an assumed role’s `sts:AssumeRole` and the Setup page’s Test button. An instance role’s credentials always come straight from the instance metadata service. On a self-managed search head, set it to `false` to connect directly, for example when an account’s endpoint override is already the way out. On Splunk Cloud neither this file nor `server.conf` can be edited, so it keeps its default there; route AWS traffic with the endpoint override instead (see Splunk Cloud).

local/aws_search.conf ini

1[aws]
2default_region = eu-central-1
3fan_out_concurrency = 16

Cache

The Cache tab, and [cache] in the file. See Concepts - caching for how the cache behaves and the per-command defaults.

Setting	Default	What it does
`enabled`	`true`	Master on/off switch - the Disable cache toggle. `false` runs every search uncached.
`ttl`	`60s`	Default freshness when a command sets no window of its own and a search sets no `cache=`.
`dir`	`$SPLUNK_HOME/var/run/os_aws_search/cache`	Where cached responses live on the search head. File only: the Setup page never offered it, and the settings REST endpoint does not accept it, because the cache sweeper deletes under whatever it names.

The Clear cache button removes every cached response immediately - for example right after rotating a credential, rather than waiting out the window. On a search head cluster it clears this member’s cache only.

Logging

The Settings tab, and [logging] in the file.

Setting	Default	What it does
`level`	`info`	Log level of the search-command process: `debug`, `info`, `warn`, or `error`. Raise it to `debug` while you reproduce an issue, then put it back. There is no `trace`: it would write request headers and response bodies into the log.
`file`	`aws_search.log`	The per-search log file, written to the search’s dispatch directory. No control on the Setup page: set it in the file, or through the settings REST endpoint (`/servicesNS/nobody/os_aws_search/aws_search/settings`), which accepts a bare file name only - no path separator and no `$`.

License

The License tab, and [license] in the file.

Setting	Default	What it does
`key`	(empty)	The signed key from your order confirmation. Empty is the free tier. Prefer entering it on the License tab, which writes it here for you and shows the decoded entitlements.

See Licensing for what a key unlocks. The key is readable only by full Splunk administrators; the setup page shows the decoded status and never the key itself.