Expanding AWS log ingestion capabilities with custom logs in Splunk Data Inputs

Last updated
Save as PDF
Share
1. Share
2. Tweet
3. Share

Amazon CloudWatch Logs (CWL) is an AWS service that enables you to centralize the logs from all of your systems, applications, and AWS services.

Splunk Data Inputs already simplifies CWL data onboarding from a wide variety of defined AWS data sources (see current documentation for full list), including:

Amazon API Gateway
AWS CloudHSM
AWS CloudTrail
Amazon DocumentDB
Amazon Elastic Kubernetes Service (Amazon EKS)
Amazon GuardDuty
AWS IAM
AWS Lambda
AWS Metadata
Amazon Relational Database Service (Amazon RDS)
AWS Security Hub
Amazon S3
AWS Load Balancer (ELB)
Amazon VPC Flow Logs

With Splunk Data Inputs, the same simplified CloudWatch ingest experience is available for an even broader array of custom AWS service and application logs. This ensures comprehensive coverage and deeper insights into AWS environments, facilitating efficient and scalable log management.

Splunk renamed Data Manager to Data Inputs to better reflect our unified approach to data ingestion. While the name changed, all your existing configurations remain the same. In Splunk 10.4 and later, a navigation panel consolidates Data Inputs and related features into a single location. From there, you can switch between pages and manage all your data from one place.

Check out this video walkthrough on how to implement this feature:

Additional resources

These additional Splunk resources might help you understand and implement these recommendations:

Splunk Blog: Splunk Data Manager’s custom logs: Expanding AWS log ingestion capabilities
Splunk Help: Data Manager
Splunk OnDemand Services: Use these credit-based services for direct access to Splunk technical consultants with a variety of technical services from a pre-defined catalog. Most customers have OnDemand Services per their Success Plan. Engage the ODS team at ondemand@cisco.com if you would like assistance.