Building for the Splunk Platform

what type is the best for collecting data from aws cloud watch logs to splunk and CloudTrail

net1993
Path Finder

Hello
I don't have any knowledge of aws but I want to collect data in splunk from there.
I have a an aws guy for the aws tasks but I have it difficult to find out whether I am using the wrong add-on in splunk to collect data or the problem is wrong configuration of aws.

So I need to collect CloudWatch Logs and CloudTrail from different aws accounts and the goal is to separate data from different accounts in different indexes in splunk.

  1. What is difference between cloudwatch logs and cloudwatch logs VPC in simple language and does these two have difference regarding collecting way (different add on?) of data as when I read different docs , the two are mentioned often but I become confused whether I need to take into consideration something more
  2. What is the best way to get CloudWatch Logs to splunk ? Aws app or Kinesis fire.. add on given the above requirement? Currently there has been created some configuration in aws so the data is supposed to be in kinesis stream so I have created input in AWS add-on in splunk (New Input -> Others -> Kinesis) but there is comming only 1event per hour so I am not sure whether is wrong approach.
  3. What about the solution regarding CloudTrail to Splunk? Current setup is input from aws add on in splunk but I am not able to choose the iam roles but only the primary account.

Thank you in advance.

Tags (1)
0 Karma

net1993
Path Finder

No one can help with this?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...