How to use Lambda to push logs to Splunk Cloud

[richah]

I'm trying to onboard data from AWS to Splunk Cloud and planning to use Lambda But we have numerous options within Lambda. I'm confused to use Lambda blueprint to do custom one.
Lambda blueprint doesn't scale well for large number of log groups? But what if I use one lambda per account?
And there is also S3 with lambda. And there is one more method to use AWS SAM.
I'm confused which one to choose(I dont want to use kinesis). How do I choose and on what basis can I choose an option?
And I want to automate subscribing and want sourcetype per service

[livehybrid]

Hi @richah 

Is there any specific reason you dont want to use Firehose? If you are worried about the scalability then Firehose would be the best approach, in my opinion.

If you want to stick to Lambda only then you could look at https://www.splunk.com/en_us/blog/platform/stream-amazon-cloudwatch-logs-to-splunk-using-aws-lambda.... which just uses a Lambda with a Subscription Filter. 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing