We have Splunk Heavy Forwarder running in a couple of different regions/accounts in AWS.
We need to ingest the CloudWatch Logs into Splunk Heavy Forwarder. And the architecture proposed is as follows
CloudWatch Logs (multiple accounts) >> Near-real time streaming through KDF >> S3 Bucket (Centralized bucket) >> (SQS) >> Splunk Heavy Forwarder.
We are looking for a implementation document mainly for aggregating CloudWatch logs to S3 (from multiple accounts) and to improve the architecture. Direct ingestion from CloudWatch logs or KDF to Splunk is not preferred. S3 centralized logging is preferred.
We would like to reduce management overhead (hence don't prefer managing lambdas unless we have to), and also be cost effective.
Kindly include implementation documentation if available.
