All Apps and Add-ons

How to source as logStreamName using splunk-cloudwatch-logs-processor lambda blueprint?



I've been trying to configure the Lambda function splunk-cloudwatch-logs-processor from the Splunk blog article: how-to-easily-stream-aws-cloudwatch-logs-to-splunk/

But when the logs are being pushed into splunk the source is either the lambda function name or lambda:undefined
Which means all of the logs from the LogGroup are pushed into one undefinable mess. Can't tell the difference between the LogStreams within the LogGroup.

I can use the following to edit the source as "test"

           time: item.timestamp, 
           event: item.message, 
           source: "test",

But I want the source to be the logstreamname where the logs are getting pushed into splunk. Similar to how the Cloudwatch logs input on the AWS app works.
Something like:

               time: item.timestamp, 
               event: item.message, 
               source: item.logStreamName,

But i've tried this and also parsed.logSteamName and various combinations of context.logStreamName /logStream/Stream etc.

Any help appreciated.


Labels (1)
Tags (3)
0 Karma


If you have logging enabled for your lambda function, you should be able to see the names of the fields available. When looking at them, remember it will be broken down by a header section and then a list of items. The context for item is limited to the scope of that log line, but the payload you are currently working in has a scope in the javascript of parsed. For my use case, I found that I was looking for parsed.logGroup to get the name of the log group as it appears in CloudWatch to appear as my source.

Hope this is still relevant to you, or others!


@gprice this worked for me perfectly. thanks for your answer.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...