Splunk Cloud Platform

splunk cloud - SQS consumer

iherb_0718
Path Finder

Hello,

Is it possible to setup a SQS consumer on Splunk Cloud?
I have a vendor that drops logs onto an S3 bucket that is assigned to me but it is under their control.
They have also setup an SQS queue and disclosed to me the credentials.

How would you suggest that I can pull this into splunk cloud?

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @iherb_0718,

You can use the Splunk Add-on for Amazon Web Services app to ingest logs from SQS queue.

https://splunkbase.splunk.com/app/1876/ 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

iherb_0718
Path Finder

Scelikok would that still work if the S3 bucket is on the vendor's AWS tenant (account)? 

I was under the impression that the app would need to be configured for a particular account and then you can setup inputs for SQS queues from that account.  I believe my company has that app today configured for our own account already.

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Since add-on support multiple accounts and inputs, I don't think it will be a problem.

If this reply helps you an upvote is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @iherb_0718,

You can use the Splunk Add-on for Amazon Web Services app to ingest logs from SQS queue.

https://splunkbase.splunk.com/app/1876/ 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.
0 Karma

iherb_0718
Path Finder

I've been having some problems with getting this to work through the AWS app.

However, I believe now have a viable solution.  The vendor has a python script that will set up the SQS consumer.  I'll edit this .py script and fill in the AWS credential and S3 information.

I intend to load this Python script on an ubuntu 18.04 OS that is running the universal forwarder.  The logs will come into this host. 

Will I be able to direct Universal forwarder to look into a particular directory to collect the logs? Will it be the inputs.conf file to make the change?

 

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>