Hi @richah  Is there any specific reason you dont want to use Firehose? If you are worried about the scalability then Firehose would be the best approach, in my opinion. If you want to stick to Lambda only then you could look at https://www.splunk.com/en_us/blog/platform/stream-amazon-cloudwatch-logs-to-splunk-using-aws-lambda.html which just uses a Lambda with a Subscription Filter.  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

We are using classic splunk cloud, so data manager is not available. Can we do role assumption from IAM User Credential ?? As you said IAM User Credential (Access/Secret key combo with optional role assumption from that),  can you please attach the link. I don't seem to find any link for assumerole in splunk documentation. ... View more

Hi @richah , you can install Data Manager in your Splunk Cloud Instance and I hint to do this because this app has a very user friendly interface to configure inputs. Anyway, you can use the AWS add-on. Ciao. Giuseppe ... View more