All Apps and Add-ons

Process AWS VPC Flow Logs before indexing.

alonsocaio
Contributor

Hello,

I am sending AWS VPC Flow logs to Splunk using the Splunk App for AWS and and I'm using the SQS based inputs. Since VPC Flow logs are generating a huge amount of data, I'd like to do some processing on these logs before sending it to the indexers.

Does anyone have any idea on how to perform some flow aggregation, for logs containing same src address/port, dest address/port, interface id and account id within a time range? Or have you needed to use another way to reduce the amount of logs received from VPC Flow?

I'm also planning to send VPC Flow logs using Kinesis Firehose.

0 Karma
1 Solution

alonsocaio
Contributor

I have decided to use an external tool, such as Cribl, to perform VPC Flow aggregation.

View solution in original post

Gene
Path Finder

Nice promotion of Cribl 🙂

I have heard only good things about it, will need to check.

Good luck and happy splunking!

 

0 Karma

alonsocaio
Contributor

I have decided to use an external tool, such as Cribl, to perform VPC Flow aggregation.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!