Getting Data In

Help with firehose ingestion

brent_weaver
Builder

Hello all... I am trying to use the Splunk-Trumpet project to a HEC end point with indexer ack, a valid SSL cert and internet facing. I can use curl to POST data to this endpoint with SSL enabled, so this tells me that at the most basic levels my HEC and it's associated infra is setup right.

Since this sets up an S3 bucket for backup should the firehose fail, i am able to browse that and I see the following message:

<Error>
<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>E1B619A2DC6BDD3F</RequestId>
<HostId>
pBxYzfWxtG+IfA77uG2ozJ3RNaEf8h4lv83lRDCJ7hmBYU4cPRMSRKk8CxNP761OjONm21jZNLM=
</HostId>
</Error>

Any help is MUCH appreciated, this is a HUGE improvement over the previous ingestion methods.

0 Karma

badrinath_itrs
Communicator

This appears to be some sort of problem with AWS Permission.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...