All Apps and Add-ons

Splunk App and Add-on for Amazon Web Services: Why are Cloudwatch log groups missing from VPC flow logs input?


I have installed the Splunk App for AWS, but when I try to configure vpc flow logs, it is not listing all the log groups. Instead, it is only showing a few log groups that start with /aws/lambda/XXXX . Why am not able to list all the log groups?

Splunk version = 6.4.1
Splunk Add-on for Amazon Web Services version = 4.0.0
Splunk App for AWS = 4.2.0

Manual configuration tried:


[xxx-Cloudwatch Logs]
account = xxx-xxxx
delay = 1800
groups = xxx-log-group-name
index = default
interval = 600
only_after = 1970-01-01T00:00:00
region = us-east-1
sourcetype = aws:cloudwatchlogs:vpcflow
stream_matcher = .*
0 Karma

Splunk Employee
Splunk Employee

Alternatively, if Splunk HTTP Event Collector (HEC) is enabled in your particular Splunk deployment, consider instead streaming CloudWatch Logs into Splunk via Lambda, that is CloudWatch Logs --> Lambda --> Splunk HEC, as explained in this blog post:

In addition to near real-time data ingestion, you could benefit from automated configuration management. More specifically, instead of having to manually create a CloudWatch Logs input in Splunk for each logs group, you can have these Lambda functions automatically created (part of CloudFormation template, AWS CLI or other methods) and stream to the same Splunk HEC input.

0 Karma

Splunk Employee
Splunk Employee

It's a known issue in aws app 4.2.0. It will be part of our 4.2.1 maintenance release. Or you can ask support to fix it by looking at JIRA AWSAPP-968.
Workaround before 4.2.1:
1. Ask support to follow AWSAPP-968 to fix
2. Use addon to configure this input

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...