All Apps and Add-ons

How do we integrate Amazon SES with Splunk without linking Cloudwatch or Kinesis Firehose?


I want to integrate AWS SES with Splunk without Cloudwatch or Kinesis Firehose. Is there a way to do that. I want all the SES events/logs to get generated into Splunk DLP.

How can I do that?

Labels (1)

Path Finder

I successfully forward my SES notifications to Splunk via the following process:

  • create SNS topic, e.g. "ses-notifications-topic"
  • create SQS queue, e.g. "ses-notifications-queue"
  • from the SQS queue's right-click menu, 'Configure queue" and change Default Visibility Timeout = 5 min (Splunk recommended value)
  • again from the right-click, 'Add subscription' (then select the SNS topic)
  • in the IAM policy for my Splunk service-account, I specifically add sqs:List*/Get*/DeleteMessage permissions and with that particular SQS queue as the Resource
  • in the Splunk Add-on for AWS, create new Input of type 'Custom / SQS', then point it at the SQS queue and set sourcetype=aws:ses
  • finally, back in the SES console, update the Notifications to send to the new SNS topic

The problem I have, actually, is with parsing the events correctly. The message details are not being extracted even though they're in JSON. Probably some simple setting I'm missing. (I also found a "Splunk SES App" from a third-party but it doesn't seem to work.)

P.S. I have the optional SES notification setting, "Include original headers" but I don't think that's the issue.

0 Karma


The only methods AWS lists for publishing the data is "Amazon CloudWatch or Amazon Kinesis Data Firehose, or by Amazon SNS notification".
You can't get around AWS rules for publishing the data. Maybe I don't understand your question?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!