What is the recommended way to ingest AWS Cloudwatch Logs?

[tshawver_ta]

According to the AWS add-on for Splunk, it is strongly recommended to avoid using the Cloudwatch Logs input due to deprecation.

Screenshot from the docs at http://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatchLogs :

I have countless AWS Lambda functions which dump their logs to CloudWatch Logs. What is the recommended way to ingest these? Ideally, I'd like them to be available in Splunk in real time, similarly to how they are with our server applications pushing logs through SplunkForwarder.

[jheriksahl64]

Has anyone else come up with a way to have Splunk pull from AWS versus push (which the later answers are using)? We have our Splunk on-prem and our AWS Cloudwatch logs (no VPC logs) and have a firewall inbetween. The best approach would be to do a pull (which is what we had hoped this plugin would do) but it sounds like that is not the case (or not reliable)? Has anyone else accomplished what we are after or are we stuck with the push option only?

[gjanders]

I believe the Amazon Kensis firehose is the new preferred method according to this Splunk blog post

The application for Splunk Add-on for Amazon Kinesis Firehose appears to be the relevant application...

EDIT: not available in all regions such as Australia.... https://www.splunk.com/blog/2017/02/03/how-to-easily-stream-aws-cloudwatch-logs-to-splunk.html might be the alternative for now as per apringle's comment.

[apringle]

I'm currently investigating how to do this myself. It seems like the referenced docs have been updated to show that VPC Flow Logs specifically should be avoided, and no longer says CloudWatch Logs in general. I don't know for certain though (I haven't seen the official deprecation notice). Here's the current text:

Splunk strongly recommends against using the CloudWatch Logs inputs to collect VPC Flow Logs data (source type: aws:cloudwatchlogs:vpcflow) since the input type will be deprecated in upcoming releases. Configure Kinesis inputs to collect VPC Flow Logs instead. The add-on includes index-time logic to perform the correct knowledge extraction for these events through the Kinesis input as well.

However, it seems like this is probably a good alternative solution to get any CloudWatch Logs into Splunk:

https://www.splunk.com/blog/2017/02/03/how-to-easily-stream-aws-cloudwatch-logs-to-splunk.html

My understanding is that it would give you a real-time push rather than the polling method that the AWS add-on input provides.

[toamarnath]

Does anyone have a answer of how to build a lambda function through python (snippet if anyone has it) to ingest cloudwatch logs to be available in real time to splunk,

[lulu_mtan]

There's a Lamda blueprint for Splunk. Also see: https://www.splunk.com/blog/2017/02/03/how-to-easily-stream-aws-cloudwatch-logs-to-splunk.html