Most of Search for AWS is configured on the Accounts tab of the Setup page. The settings on this page are the rest: runtime values you rarely need to touch, but that are there when you want to change the default region, tune fan-out concurrency or request timeouts, adjust the response cache, or raise the log level. All but two are on the Setup page’s Settings and Cache tabs - the cache directory is set in the file only, and the log file’s name in the file or through the app’s settings REST endpoint - and all of them live in aws_search.conf.
A field left blank keeps the shipped default. A change is picked up by the next search - no restart. On Splunk Cloud the tabs are the only way to set these values; on a self-managed search head you can also edit the file:
$SPLUNK_HOME/etc/apps/os_aws_search/local/aws_search.confAn app upgrade overwrites default/, so a value set there is lost on the next release; local/ always wins and survives upgrades, and the Setup page writes local/ for you. The bundled README/aws_search.conf.spec is the exhaustive schema.
AWS requests
The Settings tab, and [aws] in the file.
| Setting | Default | What it does |
|---|---|---|
default_region | us-east-1 | Used when an account has no default region of its own and the search sets no region=. |
fan_out_concurrency | 8 | How many account and region pairs one search queries at once during a fan-out (ceiling 64). A search’s concurrency= argument overrides it. |
request_timeout | 30s | Caps one AWS API request, not the whole search. An async command such as awsathena or awslogs makes many bounded requests over its life. |
1[aws]
2default_region = eu-central-1
3fan_out_concurrency = 16Cache
The Cache tab, and [cache] in the file. See Concepts - caching for how the cache behaves and the per-command defaults.
| Setting | Default | What it does |
|---|---|---|
enabled | true | Master on/off switch - the Disable cache toggle. false runs every search uncached. |
ttl | 60s | Default freshness when a command sets no window of its own and a search sets no cache=. |
dir | $SPLUNK_HOME/var/run/os_aws_search/cache | Where cached responses live on the search head. File only: the Setup page never offered it, and the settings REST endpoint does not accept it, because the cache sweeper deletes under whatever it names. |
The Clear cache button removes every cached response immediately - for example right after rotating a credential, rather than waiting out the window. On a search head cluster it clears this member’s cache only.
Logging
The Settings tab, and [logging] in the file.
| Setting | Default | What it does |
|---|---|---|
level | info | Log level of the search-command process: debug, info, warn, or error. Raise it to debug while you reproduce an issue, then put it back. There is no trace: it would write request headers and response bodies into the log. |
file | aws_search.log | The per-search log file, written to the search’s dispatch directory. No control on the Setup page: set it in the file, or through the settings REST endpoint (/servicesNS/nobody/os_aws_search/aws_search/settings), which accepts a bare file name only - no path separator and no $. |
License
The License tab, and [license] in the file.
| Setting | Default | What it does |
|---|---|---|
key | (empty) | The signed key from your order confirmation. Empty is the free tier. Prefer entering it on the License tab, which writes it here for you and shows the decoded entitlements. |
See Licensing for what a key unlocks. The key is readable only by full Splunk administrators; the setup page shows the decoded status and never the key itself.