Cloudwatch logs streaming to splunk

[rajiv_r]

in splunk cloud i am trying to push RDS cloudwatch logs in splunk through creating New Input option but i could not able to do it. Also i tried with the custom data type option by adding the log group but i cound not able to stream the logs in SPlunk. Does streaming cloudwatch logs in splunk has been depreciated? . can someone please help me in this?.

[amiracle]

How are you sending your logs into Splunk? Did you use Lambda functions to send the data directly to HEC (http event collector) or are you using the old modular input for Cloudwatch logs on a Heavy Forwarder? You can send data directly from CloudWatch Logs via Lambda function into Splunk Cloud directly.

[rajiv_r]

I am using the metric configuration by using the Create new Input option and also by providing the log group name in the Custom Data type option which is availbale in splunk cloud

[amiracle]

Are you trying to get metrics or logs? These are two different data sources and are collected differently. CloudWatch logs can be collected either with a Lambda function to HEC or Kinesis Data Firehose into HEC. CloudWatch metrics can only be collected with a heavy forwarder (pull).

If you are getting the RDS Logs, then your best bet is either Firehose or Lambda functions.