Splunk Dev

what type is the best for collecting data from aws cloud watch logs to splunk and CloudTrail

Path Finder

I don't have any knowledge of aws but I want to collect data in splunk from there.
I have a an aws guy for the aws tasks but I have it difficult to find out whether I am using the wrong add-on in splunk to collect data or the problem is wrong configuration of aws.

So I need to collect CloudWatch Logs and CloudTrail from different aws accounts and the goal is to separate data from different accounts in different indexes in splunk.

  1. What is difference between cloudwatch logs and cloudwatch logs VPC in simple language and does these two have difference regarding collecting way (different add on?) of data as when I read different docs , the two are mentioned often but I become confused whether I need to take into consideration something more
  2. What is the best way to get CloudWatch Logs to splunk ? Aws app or Kinesis fire.. add on given the above requirement? Currently there has been created some configuration in aws so the data is supposed to be in kinesis stream so I have created input in AWS add-on in splunk (New Input -> Others -> Kinesis) but there is comming only 1event per hour so I am not sure whether is wrong approach.
  3. What about the solution regarding CloudTrail to Splunk? Current setup is input from aws add on in splunk but I am not able to choose the iam roles but only the primary account.

Thank you in advance.

Tags (1)
0 Karma

Path Finder

No one can help with this?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...