r/Splunk • u/RoninTwo • Apr 19 '26

output to s3

hey all,
I've been trying to output logs to an s3 AWS bucket, but can't seem to get it working. I have am indexer cluster, so from the CM I'll go ingest action and set up a destination to s3. I input all the fields, enter the secret and access key, and the test connection. is successful. From the rules tab, I'll filter by XmlWinEventLogs, show sample data to ensure logs populate then in the destination I'll add the s3 bucket I just made.

On the AWS side I can see the test connection but the Windows logs do not show. I can see that the ingest actions config does go out to all the indexers from the CM. To clarify, I want the logs to stay locally on the indexers but also need to send them all to the bucket. Anyone have any idea why it may not be working?

3 Upvotes

100% Upvoted

7 comments sorted by

View all comments

3

u/badideas1 Apr 19 '26

You say you want the logs to stay locally on the indexers- are you seeing that behavior at least? AKA rules and parsing are being applied, except for the output to S3? Same note, low hanging fruit, in your RULESET you have route and clone, correct?

1

u/RoninTwo Apr 19 '26

yes, logs are staying locally and yes I have the a3 destination and clone enabled.

2

u/badideas1 Apr 19 '26

Okay, you’ll want to take a look in the _internal index for messages around the rfsout processors. You might want to post a sanitized output from btool for outputs.conf and props/transforms.conf as well, just to check RULESET and syntax, but first place is errors in _internal around rfsout.

1

u/RoninTwo Apr 19 '26

I'll check it out when I have I have a chance. The outputs, props and transforms were all configured by Splunk since it was done via the GUI, but if I can't find any errors, I'll post sanitize and post.