Search for AWS

Search for AWS brings your AWS accounts into Splunk search, live. Its SPL commands call the AWS APIs as you search and stream the answer into the pipeline, so you join AWS with everything Splunk already holds, and nothing is ingested or indexed. Any resource, every account. | awsget lists any resource kind Cloud Control can list, from EC2 instances to IAM roles. account=* fans out in parallel across the accounts you register and region=* across each account's allowed regions; an account or region that fails does not stop the others, and the search says which failed. Logs, metrics, activity and cost. | awslogs tails CloudWatch Logs and runs Logs Insights, | awsmetrics charts CloudWatch metrics and reads alarms and their history, | awscloudtrail looks up management events, | awscost reads Cost Explorer, | awsathena, | awsglue and | awstag cover the rest, and | awsjson expands the JSON they return. More than thirty dashboards. Compute, Networking, Storage, Databases, App Integration, Analytics, Security, Observability and Management, grouped the way the AWS console groups them, each with a page per resource, plus an Overview that opens on what needs attention, a Metrics Explorer, Log Tail, Logs Insights, CloudTrail explorers, and Cost & Usage. Your credentials, your boundary. Access keys, a cross-account role to assume with an external ID, or the EC2 instance role, with every secret kept in Splunk's encrypted credential store, and per-user credentials for analysts who should search as themselves. AWS IAM stays the boundary, and by default an assumed role's session names the Splunk user in CloudTrail. Costs in view. The docs say what AWS bills for each command, and a short-lived cache keeps a repeated search from calling AWS again. Free for one account. The free tier runs one account, with access keys or the instance role, on a standalone search head, with no license key. A license adds more accounts, search head clustering, assumed roles and per-user credentials. Works on Splunk Enterprise 9.4, 10.0, 10.2, 10.4 and 10.6 and on Splunk Cloud, on a search head. The app sends no telemetry. Documentation: https://www.outcoldsolutions.com/docs/aws-search/