Deployment Architecture

Getting logs from S3 to Splunk


Hi Splunkers ,


We have decided to use S3 as centralized collection of logs from various sources. I have the following questions to have have the best way to get data into Splunk from S3.  Daily ingestion of logs will be around 5 Gb. There will be multiple inputs needs to be created to read each s3 buckets.


Questions :

1. I see there are 2 Addon's available.  Splunk Add-on for AWS and  Splunk Add-on for Amazon Kinesis Firehose. Will both Add-on supports reading data from s3? If so which is the best method?

2. Splunk Add on Aws has 3 input types : Generic S3 , Incremental S3 , SQS based S3. Which will be the best method to ingest data from multiple directories and around 5Gb per day.

3. Recommended hardware for Heavy forwarder.


Thanks in Advance.



Labels (1)
Tags (1)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!