Hello,
I am sending AWS VPC Flow logs to Splunk using the Splunk App for AWS and and I'm using the SQS based inputs. Since VPC Flow logs are generating a huge amount of data, I'd like to do some processing on these logs before sending it to the indexers.
Does anyone have any idea on how to perform some flow aggregation, for logs containing same src address/port, dest address/port, interface id and account id within a time range? Or have you needed to use another way to reduce the amount of logs received from VPC Flow?
I'm also planning to send VPC Flow logs using Kinesis Firehose.
