Process AWS VPC Flow Logs before indexing.

[alonsocaio]

Hello,

I am sending AWS VPC Flow logs to Splunk using the Splunk App for AWS and and I'm using the SQS based inputs. Since VPC Flow logs are generating a huge amount of data, I'd like to do some processing on these logs before sending it to the indexers.

Does anyone have any idea on how to perform some flow aggregation, for logs containing same src address/port, dest address/port, interface id and account id within a time range? Or have you needed to use another way to reduce the amount of logs received from VPC Flow?

I'm also planning to send VPC Flow logs using Kinesis Firehose.

[Gene]

Nice promotion of Cribl 🙂

I have heard only good things about it, will need to check.

Good luck and happy splunking!

[alonsocaio · Accepted solution]

I have decided to use an external tool, such as Cribl, to perform VPC Flow aggregation.