Splunk Add on for AWS "SQS-Based S3" Cloudformation Templates

[rvadde]

Greetings, 

Are there any official AWS CFT Templates to create necessary roles, SNS/SQS Services to use Splunk Add on for AWS to ingest Cloudtrail Data into Splunk? 

[livehybrid]

There arent any official Cloudformation Templates for sending data from Cloudtrail to S3/SQS as far as I know, however there is Project Trumpet (https://github.com/splunk/splunk-aws-project-trumpet) which helps create Cloudformation for HEC based Cloudtrail (and others) feeds from AWS, if this helps?

If you are using Splunk Cloud then you can also use the Data Manager app which can help setup AWS feeds into Splunk, but again I believe this uses Firehose/HEC rather than SQS based S3.

I hope one of these helps you get started.

Will