What is the difference between AWS AMIs 'Splunk Enterprise' and 'Splunk Insights for AWS Cloud Monitoring'

[dkolev]

Hi,
I see there are two flavors of Splunk AWS AMI on the marketplace:
Splunk Enterprise
and
Splunk Insights for AWS Cloud Monitoring

What is the difference if any?
Which one I should use to ingest and visualize the S3 Logs / CloudTrail on my AWS VPC environment?

Thanks,

[nkwong_splunk · Accepted solution]

Splunk Insights for AWS Cloud Monitoring is an AMI running Splunk Light and is pre-packaged with the Splunk App for AWS and the Splunk Add-On for Amazon Web Services. The Splunk Enterprise AMI is only running the Splunk Enterprise software without any apps or add-ons pre-packaged.

If your daily indexing volume is less then 20GB/day, you can start with the Splunk Insights for AWS Cloud Monitoring to monitor your S3 logs/CloudTrail/etc. If your daily indexing volume will be above 20GB/day, you can either upgrade your Splunk Insights for AWS Cloud Monitoring instance to a Splunk Enterprise license or you can start with the Splunk Enterprise AMI and install the Splunk App for AWS and the Splunk Add-On for Amazon Web Services.

Here is a platform comparison between Splunk Light, Splunk Enterprise, Splunk Cloud, etc.
https://www.splunk.com/en_us/software/features-comparison-chart.html