https://community.splunk.com/t5/Getting-Data-In/Can-Data-Manager-import-Cloudwatch-ECS-Fargate-logs/m-p/670729#M112452 <P>I'm using current Cloud Splunk:</P><P>It appears the older "<STRONG>Splunk Add-on for AWS</STRONG>" <EM>can</EM> stream in Cloudwatch log-group data through <STRONG>Inputs &gt; Custom Data Type &gt; Cloudwatch Logs</STRONG>. This asks for a comma separated log-groups to feed of of and presumably setups up ingest for them.</P><P>Data Manager has a <STRONG>Cloudwatch Logs </STRONG>section,&nbsp; but it appears to only cover</P><UL><LI>AWS Cloudtrail</LI><LI>AWS Security Hub</LI><LI>Amazon Guard Duty</LI><LI>IAM Access Analyzer</LI><LI>IAM Credential support</LI><LI>Metadata (EC2, IAM, Network ACLs, EC2 sec groups)</LI></UL><P>Am I just missing something in Data Manager, does it support ingesting Cloudwatch log-groups?</P><P>Should I use "Splunk Add-On for AWS"?</P><P>Should forgo both and instead use the splunk log driver with the container tasks as per <A href="https://repost.aws/knowledge-center/ecs-task-fargate-splunk-log-driver" target="_blank" rel="noopener">https://repost.aws/knowledge-center/ecs-task-fargate-splunk-log-driver</A> (posted a year ago)</P><P>Thank you!</P> Tue, 05 Dec 2023 00:07:12 GMT nramella 2023-12-05T00:07:12Z https://community.splunk.com/t5/Getting-Data-In/Can-Data-Manager-import-Cloudwatch-ECS-Fargate-logs/m-p/670729#M112452 <P>I'm using current Cloud Splunk:</P><P>It appears the older "<STRONG>Splunk Add-on for AWS</STRONG>" <EM>can</EM> stream in Cloudwatch log-group data through <STRONG>Inputs &gt; Custom Data Type &gt; Cloudwatch Logs</STRONG>. This asks for a comma separated log-groups to feed of of and presumably setups up ingest for them.</P><P>Data Manager has a <STRONG>Cloudwatch Logs </STRONG>section,&nbsp; but it appears to only cover</P><UL><LI>AWS Cloudtrail</LI><LI>AWS Security Hub</LI><LI>Amazon Guard Duty</LI><LI>IAM Access Analyzer</LI><LI>IAM Credential support</LI><LI>Metadata (EC2, IAM, Network ACLs, EC2 sec groups)</LI></UL><P>Am I just missing something in Data Manager, does it support ingesting Cloudwatch log-groups?</P><P>Should I use "Splunk Add-On for AWS"?</P><P>Should forgo both and instead use the splunk log driver with the container tasks as per <A href="https://repost.aws/knowledge-center/ecs-task-fargate-splunk-log-driver" target="_blank" rel="noopener">https://repost.aws/knowledge-center/ecs-task-fargate-splunk-log-driver</A> (posted a year ago)</P><P>Thank you!</P> Tue, 05 Dec 2023 00:07:12 GMT https://community.splunk.com/t5/Getting-Data-In/Can-Data-Manager-import-Cloudwatch-ECS-Fargate-logs/m-p/670729#M112452 nramella 2023-12-05T00:07:12Z