https://community.splunk.com/t5/Getting-Data-In/Best-AWS-ingestion-approach/m-p/551113#M91501 <P>Hello,</P><P>I am trying to settle on a new AWS event collection strategy.&nbsp; We are currently collecting using the older pull (SQS/SNS) method, and would like to move to a more modern and flexible way of doing it.&nbsp; Would like to collect AWS Config, CloudTrail, VPC Flow logs, CloudWatch, GuardDuty events from 100+ accounts into Splunk.&nbsp; Also would like a filtering capability at the source where logs can be discarded based on some criteria (account or arn) and not sent to Splunk to be filtered.&nbsp; &nbsp;</P><P>Seems like Splunk has changed their recommendations in the last few years (lambda push, firehouse, etc)_, and I am not certain what is the recommended approach now to do this now with as little complexity as possible.&nbsp; Project Trumpet seems like a good option, but&nbsp; I am not seeing Splunk steer people to that.&nbsp; &nbsp;Also unclear what caveats are with each of these approaches.&nbsp; If you go the Firehose route, how do you discard unwanted events?&nbsp; Also there are cost considerations and it's unclear which approach is more cost effective.</P><P>Wondering what people have settled on in similar circumstances and why.&nbsp; Thanks!</P> Mon, 10 May 2021 16:54:05 GMT oleg106 2021-05-10T16:54:05Z https://community.splunk.com/t5/Getting-Data-In/Best-AWS-ingestion-approach/m-p/551113#M91501 <P>Hello,</P><P>I am trying to settle on a new AWS event collection strategy.&nbsp; We are currently collecting using the older pull (SQS/SNS) method, and would like to move to a more modern and flexible way of doing it.&nbsp; Would like to collect AWS Config, CloudTrail, VPC Flow logs, CloudWatch, GuardDuty events from 100+ accounts into Splunk.&nbsp; Also would like a filtering capability at the source where logs can be discarded based on some criteria (account or arn) and not sent to Splunk to be filtered.&nbsp; &nbsp;</P><P>Seems like Splunk has changed their recommendations in the last few years (lambda push, firehouse, etc)_, and I am not certain what is the recommended approach now to do this now with as little complexity as possible.&nbsp; Project Trumpet seems like a good option, but&nbsp; I am not seeing Splunk steer people to that.&nbsp; &nbsp;Also unclear what caveats are with each of these approaches.&nbsp; If you go the Firehose route, how do you discard unwanted events?&nbsp; Also there are cost considerations and it's unclear which approach is more cost effective.</P><P>Wondering what people have settled on in similar circumstances and why.&nbsp; Thanks!</P> Mon, 10 May 2021 16:54:05 GMT https://community.splunk.com/t5/Getting-Data-In/Best-AWS-ingestion-approach/m-p/551113#M91501 oleg106 2021-05-10T16:54:05Z