topic Re: Does Splunk App for AWS work without the Add-On? in All Apps and Add-ons

Does Splunk App for AWS work without the Add-On?

aknsun — Wed, 12 Jun 2019 09:09:56 GMT

Hi,

Just trying to understand more the workings of the Add-On & Splunk for AWS App.

We have an existing Index that is being ingested with CloudTrail data via UF on a server that stores the cloudtrail data in log files.

Can the AWS App show the info on the dashboard if we edit the macros.conf to point to the existing Index? I'm focusing on the panel "Notable CloudTrail Activity by Origin"

Or does the App depend on the AWS Add-On?

Thanks,

AKN

Re: Does Splunk App for AWS work without the Add-On?

Shan — Wed, 12 Jun 2019 09:48:43 GMT

@aknsun,

Hope below answer, will clear your doubt..

https://answers.splunk.com/answers/593547/what-is-the-difference-between-splunk-app-for-aws.html

Thanks ..

Re: Does Splunk App for AWS work without the Add-On?

amiracle — Wed, 12 Jun 2019 12:44:12 GMT

As long as the logs are not modified and the events are clearly readable by Splunk, then your approach should work without the need for the AWS Add-on. You can also collect that data using Kinesis Data Firehose without the need for a server.