Splunk App for AWS: Getting throttling errors for a few sources, how can I limit the number of API Calls with Kinesis?

[mvadaria]

I am having an throttling error "rate exceeded" for few of source type, like aws:description:elb and few others, on the Splunk App for AWS on Splunk Cloud. As far as i know the reason of this issue is, because of API Calls limit on AWS Side. I reached out to AWS support and there is a no way to increase the API limits for any AWS account.
The way i can resolve it is by reducing the API Calls. I can use Kinesis for that. I already setup kinesis for my few log groups. where i am getting all windows server logs. but still i am getting same error. So, i still need to reduce API Call somehow. I want to move most of the inputs to Kinesis and wants to all other inputs like s3, config rule and SQS. But i don't know how to setup kinesis with s3. I can subscribe kinesis with cloudwatch log group. but not sure,
is there a way to use kinesis with S3???
Is anyone using kinesis?
Please help!

[pchen_splunk · Accepted solution]

For CloudWatch Logs, we suggest to use Kinesis for that. As you mentioned, the reason is the API throttling in CWL side.
About S3 files, you don't need to use Kinesis. What type of data do you want to ingest from S3? For AccessLogs, CloudTrail, they are supported in Incremental S3 input. For others, you can only choose Generic S3 input.

[mvadaria]

I want to use CloudTrail data in kinesis from s3. is it good solution or not? Can we do this? will it reduce/remove api throttling issue?

[pchen_splunk]

For CloudTrail data, we suggest to use incremental S3 for it.