Splunk Cloud Platform

splunk cloud - SQS consumer

iherb_0718
Path Finder

Hello,

Is it possible to setup a SQS consumer on Splunk Cloud?
I have a vendor that drops logs onto an S3 bucket that is assigned to me but it is under their control.
They have also setup an SQS queue and disclosed to me the credentials.

How would you suggest that I can pull this into splunk cloud?

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @iherb_0718,

You can use the Splunk Add-on for Amazon Web Services app to ingest logs from SQS queue.

https://splunkbase.splunk.com/app/1876/ 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

iherb_0718
Path Finder

Scelikok would that still work if the S3 bucket is on the vendor's AWS tenant (account)? 

I was under the impression that the app would need to be configured for a particular account and then you can setup inputs for SQS queues from that account.  I believe my company has that app today configured for our own account already.

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Since add-on support multiple accounts and inputs, I don't think it will be a problem.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @iherb_0718,

You can use the Splunk Add-on for Amazon Web Services app to ingest logs from SQS queue.

https://splunkbase.splunk.com/app/1876/ 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

iherb_0718
Path Finder

I've been having some problems with getting this to work through the AWS app.

However, I believe now have a viable solution.  The vendor has a python script that will set up the SQS consumer.  I'll edit this .py script and fill in the AWS credential and S3 information.

I intend to load this Python script on an ubuntu 18.04 OS that is running the universal forwarder.  The logs will come into this host. 

Will I be able to direct Universal forwarder to look into a particular directory to collect the logs? Will it be the inputs.conf file to make the change?

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...