Cloudflare R2 Log Ingestion is a Splunk Technology Add-on (TA) that pulls Cloudflare Logpush log files directly from a Cloudflare R2 bucket into Splunk, using a purpose-built modular input that speaks R2's S3-compatible API. Key capabilities: - Works with any Cloudflare Logpush dataset (Gateway DNS, HTTP Requests, Access, Audit, and more) - fully dataset-agnostic - One input per bucket/prefix, each with its own sourcetype and index, so a single Splunk instance can ingest multiple Logpush datasets side by side - Credentials live in a reusable, encrypted Account (stored via Splunk's storage/passwords, never in inputs.conf); any number of Cloudflare accounts can feed the same Splunk instance - Checkpointing via a typed KV Store processed-key set plus a configurable lookback window, so restarts don't lose progress and late-delivered Logpush batches are still picked up (not a single fragile monotonic cursor) - The R2 access layer is pure Python standard library - no boto3, no botocore, no vendored AWS SDK to keep patched Pairs well with the Cloudflare App for Splunk for dashboards and field extractions once the data is in Splunk. Requirements: Splunk Enterprise 9.4 or higher. Requires KV Store, so it runs on a heavy forwarder, IDM, standalone, or search head - not a Universal Forwarder. This release targets on-premises Splunk Enterprise only; Splunk Cloud is not currently a supported deployment target.