AWS CLI Ouput formats to SPLUNK

[tb5821]

0

I'm using the AWS CLI to get some Kinesis metrics - part of that I'm able to specify the output format as one of the below: https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html#cli-quick-configuration-for...

I've tried TEXT as that seems the most reasonable for splunk but I think the line separated data is messing up splunks ingest:

METRICDATARESULTS   iteratorAgeMilliseconds itagemillis PartialData
METRICDATARESULTS   readProvisionedThroughputExceeded   itagemillis PartialData
TIMESTAMPS  2020-04-15T20:21:00+00:00
TIMESTAMPS  2020-04-15T20:20:00+00:00
TIMESTAMPS  2020-04-15T20:19:00+00:00
TIMESTAMPS  2020-04-15T20:18:00+00:00
TIMESTAMPS  2020-04-15T20:17:00+00:00
TIMESTAMPS  2020-04-15T20:16:00+00:00
VALUES  0.0
VALUES  0.0
VALUES  0.0
VALUES  0.0
VALUES  0.0
VALUES  0.0
METRICDATARESULTS   writeProvisionedThroughputExceeded  itagemillis PartialData
TIMESTAMPS  2020-04-15T19:36:00+00:00
TIMESTAMPS  2020-04-15T19:35:00+00:00
TIMESTAMPS  2020-04-15T19:34:00+00:00
TIMESTAMPS  2020-04-15T19:33:00+00:00
VALUES  0.0
VALUES  0.0
VALUES  0.0
VALUES  0.0
VALUES  0.0
VALUES  0.0

Any thoughts on either the AWS or splunk side on how best to handle ingesting this data ?