Release history

Search for AWS versions independently of the Collectord agent and the Monitoring apps, using standard semantic versioning.

1.1.0 - 2026-10-20

• New: A license covers a number of users, the Splunk users holding run_aws_search (Splunk administrators are not counted), and registers any number of AWS accounts. The License tab shows the licensed users beside the users holding the capability; more users than the license covers raise a warning there and in a bulletin message, and searches keep running.
• The free tier serves one user, the first to run a search, which an admin can change on the License tab: 1.0 allowed any number of users
• Bug fix: When AWS throttled or refused the read of one resource’s details, or the resource was deleted while the page loaded, the dashboards showing those details read it as a resource without them: the IAM page counted such a role as having no permissions boundary and missed a wildcard trust. A count built on those details now shows “n/a”, a cell “unknown”, and an Errors table names each resource that could not be read
• Bug fix: The change tables of the CloudFormation, DynamoDB, RDS, ECR, ECS, EKS, Kinesis, Load Balancers, SNS and SQS dashboards, and of the API Gateway, EC2, Lambda, SNS topic and SQS queue pages, could show no changes on an account whose CloudTrail events are mostly reads, the dashboards’ own reads included. They now read the account’s writes, and when the window holds more writes than they read, the first row says how far back they reached
• Bug fix: A CloudTrail change table could say that events before a time were not read when the whole window had been read
• Bug fix: The Networking dashboard’s All ingress rules table showed a security group with no ingress rules as one rule allowing all traffic from “(self)”, and named the source of every IPv6 or prefix-list rule “(self)”. A group with no ingress rules now has no row there, each rule names its CIDR, prefix list or security group, and “(self)” marks only a rule allowing the group itself
• Bug fix: On Splunk Free every Search for AWS command that calls AWS, and adding an account, failed with a capability error, and the health check logged an error every 5 minutes. Splunk Free’s admin, which Splunk reports with no capabilities, now holds the app’s capabilities, and the health check skips with one INFO line
• Bug fix: When the app could not read aws_search.conf or awsaccounts.conf, searches failed, but the License tab did not show searches blocked and the app’s credential endpoints still answered. The License tab now names the file, and the endpoints refuse until it is fixed

Requires Splunk Enterprise 9.4, 10.0, 10.2, 10.4, or 10.6 on a search head, or Splunk Cloud. See Requirements. Restart Splunk after upgrading.

1.0.0 - 2026-10-14

Initial release.

• Live AWS from the search bar. Eight commands query the AWS APIs as you search, with nothing ingested or indexed: | awsget lists any resource kind Cloud Control can list, | awsmetrics charts CloudWatch metrics and reads alarms and their history, | awslogs tails CloudWatch Logs and runs Logs Insights, and | awscloudtrail, | awscost, | awsathena, | awsglue, and | awstag cover the rest; a ninth, | awsjson, expands the JSON they return. See the Command reference.
• Every account and region at once. account=* fans out in parallel across the accounts you register, and region=* across each account’s allowed regions (an account without a list reads its default region, and the search says so); an account or region that fails does not stop the others, and the search says which failed. See Accounts.
• Your choice of credentials. Long-lived access keys, a cross-account role to assume with an external ID, or the EC2 instance role, with every secret kept in Splunk’s encrypted credential store, and per-user credentials for analysts who should search as themselves. See Accounts and Access control.
• A dashboard per AWS service. Compute, Networking, Storage, Databases, App Integration, Analytics, Security, Observability, and Management, grouped as the AWS console groups them, each with a page per resource, plus an Overview that opens on what needs attention, a Metrics Explorer, Log Tail, Logs Insights, CloudTrail explorers, and Cost & Usage. See Dashboards.
• Costs in view. The docs say what AWS bills for each command, a short-lived cache with per-command freshness keeps a repeated search from calling AWS again, and the Cost & Usage dashboard runs only when you submit it (the Overview’s Spend tab reads Cost Explorer when you open it). See Costs and performance.
• Configured from Splunk Web. The Setup page manages accounts, per-user credentials, the cache, settings, and the license, on Splunk Cloud too. See Configuration and Splunk Cloud.
• Access control. Roles and capabilities separate who searches from who manages accounts, and the calls CloudTrail records carry the app’s user agent and, for an assumed role, a session named after the Splunk user unless the account sets its own session name (CloudWatch’s metric reads are data events, recorded only where CloudTrail is configured to log them). See Access control.
• Search head clustering and a free tier. Clustering comes with a paid license; the free tier is one account, with access keys or the instance role, on a standalone search head, with no license key. See Licensing.

Requires Splunk Enterprise 9.4, 10.0, 10.2, 10.4, or 10.6 on a search head, or Splunk Cloud. See Requirements.

Known issues and limitations

• Commercial AWS regions only. GovCloud and China partitions are not supported.
• Athena defaults are per search. The database and the result location are | awsathena arguments, not account settings.
• The instance role is for self-managed search heads on EC2. The app reads the EC2 instance profile, not an ECS task role or an EKS service-account role. A Splunk Cloud search head has no instance role you control: there, and on ECS or EKS, use static keys, or an assumed role with base keys.
• Cost Explorer needs enabling in the AWS account before | awscost returns data, and AWS bills every Cost Explorer call.
• CloudTrail lookups are paced at the two requests a second per account and region that AWS allows, so a CloudTrail search of a long window over a busy account can take a minute or more.