We have a setup where the AWS KMS logs are sent to Splunk HEC through below flow. We are getting JSON event format but don't see the data to be doing necessary field aliasing and tagging on SH to be CIM compatible for Authentication & Change Datamodel. I already installed Splunk_TA_aws on both SH & HF.
KMS -> Kinesis Firehosse -> logstash function -> Splunk HEC (using aws:cloudtrail sourcetype)
Should I be using a different source type for this data source and data format sent through my flow? Can anyone advise if worked with KMS data for AWS.
... View more
@woodcock @somesoni2 You're too fixed on this UF part 😉 @arangineniis _not_ using UF on the source machine. He's using some local syslog daemon that's sending the events from various local files to remote destination (in this case - to Splunk). I'd even risk a guess that he's not reading the files' contents, because that would be counterproductive, but rather sending the events as an additional action to writing to the local file.
... View more