Does Splunk App for AWS work without the Add-On?

[aknsun]

Hi,

Just trying to understand more the workings of the Add-On & Splunk for AWS App.

We have an existing Index that is being ingested with CloudTrail data via UF on a server that stores the cloudtrail data in log files.

Can the AWS App show the info on the dashboard if we edit the macros.conf to point to the existing Index? I'm focusing on the panel "Notable CloudTrail Activity by Origin"

Or does the App depend on the AWS Add-On?

Thanks,

AKN

[amiracle]

As long as the logs are not modified and the events are clearly readable by Splunk, then your approach should work without the need for the AWS Add-on. You can also collect that data using Kinesis Data Firehose without the need for a server.

[Shan]

@aknsun,

Hope below answer, will clear your doubt..

https://answers.splunk.com/answers/593547/what-is-the-difference-between-splunk-app-for-aws.html

Thanks ..