diff --git a/splunk-description/README.md b/splunk-description/README.md
new file mode 100644
index 0000000..356df41
--- /dev/null
+++ b/splunk-description/README.md
@@ -0,0 +1,61 @@
+# aws-inf-setup :: splunk-description
+
+This set up the Splunk input configuration files in setup/aws\_description\_tasks.conf
+for this account and region
+
+# Usage
+Here is a simple example, the one most commonly expected to be used.
+
+```hcl
+module "splunk_description" {
+  source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//splunk-description"
+  account_alias = "ma5-gov"
+
+  ## optional
+  # api_list = ["ec2_instances","ec2_volumes",]
+  # api_interval = 3600
+}
+```
+
+## Requirements
+
+No requirements.
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
+| <a name="provider_null"></a> [null](#provider\_null) | n/a |
+| <a name="provider_random"></a> [random](#provider\_random) | n/a |
+| <a name="provider_template"></a> [template](#provider\_template) | n/a |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [null_resource.splunk_description](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
+| [random_uuid.splunk_description](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) | resource |
+| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
+| [template_file.splunk_description](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_account_alias"></a> [account\_alias](#input\_account\_alias) | AWS Account Alias | `string` | `""` | no |
+| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no |
+| <a name="input_api_interval"></a> [api\_interval](#input\_api\_interval) | Splunk description input retrieval interval | `number` | `3600` | no |
+| <a name="input_api_list"></a> [api\_list](#input\_api\_list) | Splunk description input API list | `list(string)` | `[]` | no |
+| <a name="input_override_prefixes"></a> [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component (efs, s3, ebs, kms, role, policy, security-group). This should be used primarily for common infrastructure things | `map(string)` | `{}` | no |
+| <a name="input_tags"></a> [tags](#input\_tags) | AWS Tags to apply to appropriate resources (S3, KMS).  Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no |
+
+## Outputs
+
+No outputs.
diff --git a/splunk-description/main.tf b/splunk-description/main.tf
index 6570f07..4dfaac3 100644
--- a/splunk-description/main.tf
+++ b/splunk-description/main.tf
@@ -26,7 +26,7 @@ locals {
   # remap do2 to do1 for govcloud (undo this later when accounts are renamed in splunk)
   account_alias = replace(var.account_alias, "do2", "do1")
 
-  description_defaults = local._defaults["splunk_descriptions"]
+  description_defaults = local._defaults["splunk_description"]
   api_list             = length(var.api_list) > 0 ? var.api_list : local.description_default["api_list"]
   api_interval         = var.api_interval > 0 ? var.api_interval : local.description_default["api_interval"]
   api_values           = [for x in local.api_list : format("%v/%v", v, local.api_interval)]