What data the Splunk App for AWS collects

The Splunk App for AWS can collect the following data from your AWS environment. Access this data by configuring the inputs, then exploring the relevant dashboards. For more information about which dashboards these inputs support, see Inputs overview for the Splunk App for AWS.

You can also search for data using the associated source type. When possible, the Splunk App for AWS tags the data for compliance with the Splunk Common Information Model, making it easy to integrate data from your AWS environment with your other security and infrastructure data in the Splunk platform using your own custom dashboards or those provided by other Splunk apps.

Data source	Description	Source type	CIM compliance
Config	Configuration snapshots and historical configuration data from the AWS Config service.	aws:config	Change Analysis
	Configuration change notifications from the AWS Config service.	aws:config:notification	Change Analysis
	Descriptions of your AWS EC2 instances, reserved instances, and EBS snapshots, used to improve dashboard readability.	aws:description	None
Config Rules	Compliance details, compliance summary, and evaluation status of your AWS Config Rules.	aws:config:rule	Inventory
Inspector	Assessment Runs and Findings data from the Amazon Inspector service.	aws:inspector	Inventory, Alerts
CloudTrail	Management and change events from the AWS CloudTrail service.	aws:cloudtrail	Change Analysis
CloudWatch Logs	Data from the CloudWatch Logs service.	aws:cloudwatchlogs	None
	VPC flow logs from the CloudWatch Logs service.	aws:cloudwatchlogs:vpcflow	Network Traffic
CloudWatch	Performance and billing metrics from the AWS CloudWatch service.	aws:cloudwatch	Performance, Databases
Billing	Billing reports that you have configured in AWS.	aws:billing	None
S3	Generic log data from your S3 buckets.	aws:s3	None
	S3 access logs.	aws:s3:accesslogs	None
	CloudFront access logs.	aws:cloudfront:accesslogs	None
	ELB access logs.	aws:elb:accesslogs	None