Archive

Cloudwatch logs streaming to splunk

Explorer

in splunk cloud i am trying to push RDS cloudwatch logs in splunk through creating New Input option but i could not able to do it. Also i tried with the custom data type option by adding the log group but i cound not able to stream the logs in SPlunk. Does streaming cloudwatch logs in splunk has been depreciated? . can someone please help me in this?.

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

How are you sending your logs into Splunk? Did you use Lambda functions to send the data directly to HEC (http event collector) or are you using the old modular input for Cloudwatch logs on a Heavy Forwarder? You can send data directly from CloudWatch Logs via Lambda function into Splunk Cloud directly.

0 Karma

Explorer

I am using the metric configuration by using the Create new Input option and also by providing the log group name in the Custom Data type option which is availbale in splunk cloud

0 Karma

Splunk Employee
Splunk Employee

Are you trying to get metrics or logs? These are two different data sources and are collected differently. CloudWatch logs can be collected either with a Lambda function to HEC or Kinesis Data Firehose into HEC. CloudWatch metrics can only be collected with a heavy forwarder (pull).

If you are getting the RDS Logs, then your best bet is either Firehose or Lambda functions.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!