Splunk Dev

what type is the best for collecting data from aws cloud watch logs to splunk and CloudTrail

Path Finder

I don't have any knowledge of aws but I want to collect data in splunk from there.
I have a an aws guy for the aws tasks but I have it difficult to find out whether I am using the wrong add-on in splunk to collect data or the problem is wrong configuration of aws.

So I need to collect CloudWatch Logs and CloudTrail from different aws accounts and the goal is to separate data from different accounts in different indexes in splunk.

  1. What is difference between cloudwatch logs and cloudwatch logs VPC in simple language and does these two have difference regarding collecting way (different add on?) of data as when I read different docs , the two are mentioned often but I become confused whether I need to take into consideration something more
  2. What is the best way to get CloudWatch Logs to splunk ? Aws app or Kinesis fire.. add on given the above requirement? Currently there has been created some configuration in aws so the data is supposed to be in kinesis stream so I have created input in AWS add-on in splunk (New Input -> Others -> Kinesis) but there is comming only 1event per hour so I am not sure whether is wrong approach.
  3. What about the solution regarding CloudTrail to Splunk? Current setup is input from aws add on in splunk but I am not able to choose the iam roles but only the primary account.

Thank you in advance.

Tags (1)
0 Karma

Path Finder

No one can help with this?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...