We are running Sysmon on Amazon WorkSpaces. We are trying to get the Sysmon (and other) logs into Splunk. We are currently trying to use a forwarder on the hosts.
We run "splunk clone-prep-clear-config" before creating the bundles, however the problem we are encountering is that when we create our bundles AWS is doing something behind the scenes (likely a start up and reboot) that is setting the GUIDs before the bundle is finalized. This means that every forwarder has the same GUID.
Has anyone else worked with WorkSpaces logs and how did you overcome this challenge? The other option I was thinking of trying was seeing if we can install the CloudWatch Agent and get the logs from CloudWatch instead of directly from the host.
