Forwarding data to S3 buckets before or after or while indexing into Splunk?

dm1 — Tue, 24 Aug 2021 06:03:01 GMT

I have a requirement to forward Okta logs to S3 buckets, in addition to ingesting into Splunk.

So I see there might two ways we could forward logs to S3 buckets,

one being, during input phase, where data can be cloned and forwarded to S3 bucket ?
1. In the outputs.conf, there is the below parameter which seems like an option that can fulfil above reqmt, however, its still under development.

remote_queue.sqs.large_message_store.endpoint = <URL> * Currently not supported. This setting is related to a feature that is still under development.Or after indexing logs into SplunkHowever, I am unsure, whether for both options, there is a clearly documented reliable process to achieve the outcome.Can please advise on this ?

topic Forwarding data to S3 buckets before or after or while indexing into Splunk? in Getting Data In

Forwarding data to S3 buckets before or after or while indexing into Splunk?