I am planing to ingest VPC logs into splunk through AWS add-on and also i got the other add-on ( Amazon Kinesis Firehose) which it is offering same as AWS add-on.
Could you please let me know anyone which is the best add-on to ingest VPC logs into splunk. also provide the difference between these two apps.
AWS add-on consists of all the inputs configuration of all aws logs which includes kinesis as one among them .
AWS kinesis add-on consists of inputs configuration for aws kinesis logs only .
I believe Amazon kinesis Firehose add-on is the best way to get the vpc logs because its easy to configure and uses HEC for sending the data .
Kinesis is the recommended input type for collecting VPC Flow Logs (source type: aws:cloudwatchlogs:vpcflow). This input type also supports the collection of custom data types through Kinesis streams.