Splunk® Enterprise

Add AWS Config data: Splunk Cloud

Splunk Enterprise version 7.3 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Configure inputs for the Splunk Add-on for AWS

Best practices for configuring inputs

  • Configure Simple Queue Service (SQS)-based S3 inputs to collect AWS data.
  • Configure an AWS Config input for the Splunk Add-on for Amazon Web Services on your data collection node through Splunk Web. This data source is available only in a subset of AWS regions, which does not include China. See http://docs.aws.amazon.com/general/latest/gr/rande.html#awsconfig_region for a full list of supported regions.
  • Configure a single enabled Config modular input for each unique SQS. Multiple enabled modular inputs can cause conflicts when trying to delete SQS messages or S3 records that another modular input is attempting to access and parse.
  • Disable or delete testing configurations before releasing your configuration in production.

Configure AWS services for the Config input

The Splunk Add-on for AWS collects events from a SQS that subscribes to the Simple Notification Service (SNS) notification events from AWS Config. Configure AWS Config to produce SNS notifications, and then create the SQS that the add-on can access. See http://aws.amazon.com/config/.

  1. Enable AWS Config. See http://docs.aws.amazon.com/config/latest/developerguide/setting-up.html.
  2. Specify a new S3 bucket to save the data and an SNS Topic to which Splunk software streams Config notifications. Do not use an existing bucket or SNS.
  3. Verify that you completed the setup process. If you used the AWS console, the Resource Lookup page displays.
  4. Create a new SQS.
  5. Subscribe the SQS exclusively to the SNS Topic that you created.
  6. Grant IAM permissions to access the S3 bucket and SQS to the AWS account that the add-on uses to connect to your AWS environment.


Configure a Config input using Splunk Web

To configure inputs using Splunk Web:

  1. Click Splunk Add-on for AWS in the navigation bar on Splunk Web home.
  2. Click Create New Input > Config > Config.
  3. Fill out the fields as described in the table:
Field in Splunk Web Description
AWS Account The AWS account or EC2 IAM role the Splunk platform uses to access your Config data. In Splunk Web, select an account from the drop-down list.
AWS Region The AWS region that contains the log notification SQS queue. Enter the region ID. See http://docs.aws.amazon.com/general/latest/gr/rande.html#d0e371.
SQS queue name The name of the queue to which AWS sends new Config notifications. Select a queue from the drop-down list, or enter the queue name manually. The queue name is the final segment of the full queue URL. For example, if your SQS queue URL is http://sqs.us-east-1.amazonaws.com/123456789012/testQueue, then your SQS queue name is testQueue.
Source type A source type for the events. Enter a value only if you want to override the default of aws:config. Event extraction relies on the default value of source type. If you change the default value, you must update props.conf as well.

The Splunk platform indexes AWS Config events using three variations of this source type:

  • Configuration snapshots are indexed as sourcetype=aws:config.
  • Configuration change notifications, such as ConfigurationItemChangeNotification and OversizedConfigurationItemChangeNotification, are indexed as sourcetype=aws:config:notification.
  • Logs from aws_config.log are indexed as sourcetype=aws:config:log.
Index The index name where the Splunk platform puts the Config data. The default is main.
Interval The number of seconds to wait before the Splunk platform runs the command again. The default is 30 seconds.
Last modified on 09 December, 2022
Configure data collection on your forwarders   Validate data

This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters