S3 Bucket Logging

Splunk Search

I have a bunch of web servers that are currently streaming their logs (real time) into an S3 bucket.

I have the Splunk AWS add-on installed to collect those logs but have found that it duplicates the data and given the amount of data coming in, this would kill our license very quickly. The owners of these servers will not allow us to install the UF on it. Setting up a HF is also a no go.
Is there another way to ingest those logs without duplication.
I have seen there might be a way with a custom props.conf file but I am not sure this is way.

Any ideas would be welcome.

Thanks

Get Updates on the Splunk Community!

S3 Bucket Logging

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Join the Conversation

S3 Bucket Logging

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence