S3 Bucket Logging

Splunk Search

I have a bunch of web servers that are currently streaming their logs (real time) into an S3 bucket.

I have the Splunk AWS add-on installed to collect those logs but have found that it duplicates the data and given the amount of data coming in, this would kill our license very quickly. The owners of these servers will not allow us to install the UF on it. Setting up a HF is also a no go.
Is there another way to ingest those logs without duplication.
I have seen there might be a way with a custom props.conf file but I am not sure this is way.

Any ideas would be welcome.

Thanks

Get Updates on the Splunk Community!

S3 Bucket Logging

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation

S3 Bucket Logging

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience