All Apps and Add-ons
Highlighted

AWS Cloud Watch Metrics into Splunk Cloud

Path Finder

I have read multiple threads about getting data into Splunk but just about every one is for Splunk on-prem and not Cloud. Right now, I get most of my data in using multiple HEC's (Http Event Collector) as well as Kineis Firehose via an HEC as well.

I would like to start off with getting ELB Metrics into Splunk and am looking for feedback as to the best way to get that data into Splunk. Should it be using the AWS add-on via a Heavy Forwarder? Somehow get the data into a Cloud Watch Log group (Maybe a Lambda Function) then forward with Kinesis Firehose to an HEC?

Any feedback on users who have done this or what Splunk recommends is now the best way of doing this would be greatly appreciated.

Tags (2)
0 Karma
Highlighted

Re: AWS Cloud Watch Metrics into Splunk Cloud

Contributor

I would recommend HEC - Kinesis Firehose - I have implemented both .

As I understand it - the Heavy Forwader method with soon be deprecated.

View solution in original post

Highlighted

Re: AWS Cloud Watch Metrics into Splunk Cloud

Path Finder

Ty for the answer. Apparently, Splunk still recommends doing it this way:
https://www.splunk.com/blog/2018/10/30/working-with-aws-cloudwatch-metrics.html

It is using a Heavy forwarder with the AWS Add-On and the 'Splunk Metrics Workspace' app.

0 Karma
Highlighted

Re: AWS Cloud Watch Metrics into Splunk Cloud

Contributor

See the follwing :

Blockquote

Splunk strongly recommends against using the CloudWatch Logs inputs to collect VPC Flow Logs data (source type: aws:cloudwatchlogs:vpcflow) since the input type will be deprecated in upcoming releases. Configure Kinesis inputs to collect VPC Flow Logs instead. The add-on includes index-time logic to perform the correct knowledge extraction for these events through the Kinesis input as well.

Blockquote

https://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatchLogs

0 Karma