Splunk Dev

Cloudwatch logs streaming to splunk

rajiv_r
Explorer

in splunk cloud i am trying to push RDS cloudwatch logs in splunk through creating New Input option but i could not able to do it. Also i tried with the custom data type option by adding the log group but i cound not able to stream the logs in SPlunk. Does streaming cloudwatch logs in splunk has been depreciated? . can someone please help me in this?.

Tags (2)
0 Karma

amiracle
Splunk Employee
Splunk Employee

How are you sending your logs into Splunk? Did you use Lambda functions to send the data directly to HEC (http event collector) or are you using the old modular input for Cloudwatch logs on a Heavy Forwarder? You can send data directly from CloudWatch Logs via Lambda function into Splunk Cloud directly.

0 Karma

rajiv_r
Explorer

I am using the metric configuration by using the Create new Input option and also by providing the log group name in the Custom Data type option which is availbale in splunk cloud

0 Karma

amiracle
Splunk Employee
Splunk Employee

Are you trying to get metrics or logs? These are two different data sources and are collected differently. CloudWatch logs can be collected either with a Lambda function to HEC or Kinesis Data Firehose into HEC. CloudWatch metrics can only be collected with a heavy forwarder (pull).

If you are getting the RDS Logs, then your best bet is either Firehose or Lambda functions.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...