This is all done using the Splunk Cloud Forwarder App that you download from your Splunk Cloud instance. This is found on our Splunk Cloud User Manual. For the answer to your question, you can go to the Getting Data In. ... View more

I’m sorry , I meant your Splunk Account Team. ... View more

You will not be able to send Kinesis Data Firehose to the trial Splunk Cloud instances. If you want to test this out, please contact your team and they can help you validate it through a Splunk Cloud POC. ... View more

As long as the logs are not modified and the events are clearly readable by Splunk, then your approach should work without the need for the AWS Add-on. You can also collect that data using Kinesis Data Firehose without the need for a server. ... View more

The blueprint in AWS does have the updated lambda code for the Splunk-logging function. ... View more

We do not support external ID with this Add-on. That being said, the way you are supposed to setup the multi-account solution : 1) Create the Splunk IAM Policy in both the master account (Account A) and the sub account (Account B) 2) Create an IAM User from the master account (Account A) and use the access / secret key as the Account under the AWS Add-on Account tab 3) Create an IAM Role in Account B which trusts Account A and has the Splunk Policy attached to it 4) Use the ARN for Account B IAM Role under the IAM Role tab in the Add-on for AWS 5) Setup the inputs with the Master Account A User Account, then select the AssumeRole for the Account B Role. ... View more

You don’t need the session token. When using the stsAssumeRole you don’t need the access or session token. I don’t understand what you are trying to do with the session key. ... View more

In Splunk Cloud the HEC lives on the indexers and has an ELB (Elastic Load Balancer) to spread the data across the indexing tier. ... View more

That is because you are using the REST API to interact between Stream (on the Splunk Cloud Search Head) and the endpoints. This is covered by the Splunk Cloud Service Definition (http://docs.splunk.com/Documentation/SplunkCloud/latest/Service/SplunkCloudservice) under API interaction. Sending data from Splunk Cloud via a forwarder is not currently permitted, which is what the original poster was asking to do. ... View more

Splunk Cloud does not forward data out, so this request will be declined. Per the Splunk Cloud Service Description (https://docs.splunk.com/Documentation/SplunkCloud/latest/Service/SplunkCloudservice#Enterprise_Security_service_limits_and_constraints) the only way to do "Data Egress from Splunk Cloud" is through DDSS (Data Export), REST API or for Splunk UBA. ... View more

If you are sending via HEC, why not send it to your on Prem HEC first, then forward it to Splunk Cloud using the index and forward capability of your on Prem Splunk indexers? ... View more

Yes, you need to open a support case to enable the REST API. You should also whitelist your IP's accessing the REST API. Per the Splunk Cloud Service Description : "Differences in implementation details between Splunk Cloud and Enterprise plus permissions for the sc_admin role impacts REST API access. In Splunk Cloud, you open a support ticket to enable REST API access. In addition, Splunk Cloud supports a subset of the REST API endpoints available in Splunk Enterprise. You can find more information regarding using the REST API with Splunk Cloud " ... View more

While you can mount an S3 bucket as a local disk, you'll probably want to age the data from your indexers using the Hunk Data roll feature as documented here: How Hunk Data Roll Works Setting up Data Roll ... View more

Fixed my previous response to do not. ... View more

No, we do not support External ID for the AssumeRole function. ... View more

You might want to look at this free course as well: https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html ... View more

The name of the function is CloudWatch Log processor (https://github.com/splunk/splunk-aws-serverless-apps/tree/master/splunk-cloudwatch-logs-processor). ... View more

Yes you can collect the CloudWatch Logs this way, but I would use either a Lambda function to collect them or Kinesis streams to avoid hitting your API limits by pulling the data via the Splunk Add-on. ... View more

We published a white paper to help with this type of question: https://www.splunk.com/en_us/form/getting-data-into-gdi-splunk-from-aws.html . The TL;DR version of the document for your specific use case : For high volume data, Kinesis Data Firehose (KDF) is one of the better options. If you require validation that the event made it into Splunk and you do not want to setup a HWF, then KDF makes the most sense. For either lower volume data or data which does not require event validation, but you want to collect it serverlessly, then Lambda Functions make sense. One last point, is that KDF can also be a less expensive path when compared to using CloudWatch Logs (https://aws.amazon.com/cloudwatch/pricing/ ) vs. (https://aws.amazon.com/kinesis/data-firehose/pricing/ ). ... View more

Yes, 7.2 is the current version we support in Splunk Cloud : https://docs.splunk.com/Documentation/SplunkCloud/latest/Service/SplunkCloudservice (under current version). ... View more

Fixed the link, sorry about that. -Kam ... View more

When sending data into Splunk Cloud, you'll need to forward the data in using a UF or HF (depending on your app). In this case, it seems like Tanium will send data to a syslog server and then you can forward it from there into Splunk Cloud using the forwarder app on your cloud stack. I'm not too familiar with the Tanium Connect piece For Splunk, you might want to reach out to Tanium directly about that setting. You can also hit them up on the splunk-usergroups.slack.com on the #tanium channel. ... View more

What are the two indexes you are seeing the data flow into? By default the add-on will write the data to the main or default index. Then the saved searches will summarize some of the data and put them into summary indexes. That is normal behavior, so before you stop ingesting data, let's make sure you're not looking at both the summary and default indexes. ... View more