Outcold Solutions - Monitoring Kubernetes, OpenShift and Docker in Splunk

Monitoring

Monitoring Kubernetes Monitoring OpenShift Monitoring Docker Monitoring Linux Monitoring Windows Containers

Log forwarding

Elasticsearch and OpenSearch QRadar

Live search

Kubernetes Search Search for AWS Beta

AI agent

OS AI Agent Beta
Documentation Blog Contact Us Upload support diagnostics Pricing Evaluation licenses Partners License Agreement Privacy Policy Refund & Cancellation Acceptable Use Policy FAQ Careers
Search for AWS

Release history

Search for AWS versions independently of the Collectord agent and the Monitoring apps, using standard semantic versioning.

Search for AWS is in beta and is not on Splunkbase yet; the package is available on request (see Installation). The beta build reports version 0.9.0, and this page describes it; a later beta counts up from there, and the first Splunkbase release will be 1.0.0.

0.9.0

The beta build.

  • Live search commands. | awsget (any resource kind over Cloud Control, with aliases for the common ones, detail=true, and identifier=), | awslogs (CloudWatch Logs tail and Logs Insights), | awsmetrics (CloudWatch metrics and the metric catalog), | awscloudtrail (management events), | awscost (Cost Explorer), | awsathena (Athena queries), | awsglue (the Data Catalog), | awstag (resources by tag), and | awsjson (format results). See the Command reference.
  • Multi-account, multi-region. Register accounts and target them with account= and region=, including parallel fan-out with account=* and region=*, per-target error isolation, and an optional per-account region lock.
  • Credentials. Static keys, cross-account assume-role with external id and a per-user role session name, and the EC2 instance role on self-managed search heads, with every stored secret kept in Splunk’s encrypted credential store. Per-user credential overrides.
  • Access control. Dedicated roles and capabilities; the shared and per-user credential models; CloudTrail attribution through the session name and user agent. See Access control.
  • Dashboards. One dashboard per AWS service - Compute, Networking, Storage, Databases, App Integration, Analytics, Security, Observability, and Management - each a fleet view with a detail dashboard per resource, in-place inspectors for policies and documents, a live-catalog Metrics Explorer, Log Tail and Logs Insights, CloudTrail explorers, and a submit-gated Cost & Usage. See Dashboards.
  • Caching. Short-lived on-disk cache with per-command freshness windows and a per-search cache= override; disable, tune, or clear it from the Setup page.
  • Setup page. Accounts, per-user credentials, cache, settings, and license, all from Splunk Web - the full configuration surface on Splunk Cloud.
  • Search head clustering support (paid license), with accounts, credentials, settings, and the license replicated across members.
  • Free tier: one account, with static keys or the instance role, on a single standalone search head, no license key required.

Requires Splunk Enterprise 9.4, 10.0, 10.2, or 10.4 on a search head, or Splunk Cloud. See Requirements for the full compatibility matrix.

Known issues and limitations

  • Commercial AWS regions only. GovCloud and China partitions are not supported yet.
  • Athena defaults are per search. The database and result location are | awsathena arguments, not account settings.
  • The instance role is for self-managed search heads on EC2. The app reads the EC2 instance profile; it does not read an ECS task role or an EKS service-account role. A Splunk Cloud search head has no instance role you control; use static keys, or an assumed role with base keys, there and on ECS or EKS.
  • Cost Explorer needs enabling in the AWS account before | awscost returns data, and every call is billed by AWS.