All Apps and Add-ons

Splunk Add-on for Amazon Kinesis Firehose: When to use lambda transformations?

myu_splunk
Splunk Employee
Splunk Employee

When should I use transforms via Lambda with Kinesis Firehose when sending in application data through Kinesis?

myu_splunk
Splunk Employee
Splunk Employee

You need to use a lambda transform when 1) your data is in a format that is not supported by HEC (ex: VPC flow logs), or 2) if you want to use the /events HEC endpoint for doing things like index/source/sourcetype/timestamp overriding, or 3) if you want to transform your data in any custom way before getting indexed into your Splunk deployment.

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!