Splunk container on EC2 always getting deleted

Hello.

I don't know for sure since I haven't looked at your actual EC2 metrics or load situation, but in general, t2.micro is an instance type with very small specs.
https://aws.amazon.com/ec2/instance-types/t2/?nc1=h_ls

Also, since it is a T-based instance type, CPU credits will be consumed when the load is high.
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/burstable-performance-instances.html

Therefore, the cause may be that running the container exceeds the EC2 baseline throughput and continues to consume CPU credits, causing the performance to drop to the baseline throughput.
I recommend checking the CPU credit metrics in CloudWatch metrics.
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html#cpu-credit-metrics