Splunk® Supported Add-ons

Splunk Add-on for AWS

Download manual as PDF

Download topic as PDF

Use cases for the Splunk Add-on for AWS

Use the Splunk Add-on for Amazon Web Services (AWS) to collect data on Amazon Web Services. The Splunk Add-on for AWS offers pretested add-on inputs for four main use cases, but you can create an input manually for a miscellaneous Amazon Web Service. See Configure miscellaneous inputs for the Splunk Add-on for AWS.

See the following table for use cases and corresponding add-on collection methods:

Use case Add-on inputs
Use the Splunk Add-on for AWS to calculate the cost of your Amazon Web Service usage over different lengths of time.
  • Billing (Cost and Usage report)
  • Billing (Legacy)
Use the Splunk Add-on for AWS to push CloudTrail log data to the Splunk platform. CloudTrail allows you to audit your AWS account.
  • CloudTrail
  • Kinesis data
  • S3 Access Logs
Use the Splunk Add-on for AWS to push IT and performance data on your Amazon Web Service into the Splunk platform.
  • Amazon CloudWatch data
  • CloudFront Access Logs
  • ELB Access Logs
  • Config and Config Rules data
  • Description data
  • Kinesis data
  • S3 Access Logs
  • SQS-based Access Logs
  • VPC flow log data
Use the Splunk Add-on for AWS to push security data on your Amazon Web Service into the Splunk platform.
  • Inspector data
  • Config and Config Rules data
  • Description data
  • Kinesis data
  • S3 Access Logs
  • SQS-based Access Logs
  • VPC flow log data

Consider the Splunk Add-on for Amazon Kinesis Firehose as an alternative to the Splunk Add-on for AWS

See About the Splunk Add-on for Amazon Kinesis Firehose to consider an alternative add-on for pushing AWS data to the Splunk platform. See the following table to understand the differences:

Splunk Add-on for Amazon Kinesis Firehose Splunk Add-on for AWS
Pushes data. Pulls data.
For high volume, streaming data. For low volume, rarely changing data.
If high availability and scale are required for your deployment. For normal availability and scale.
Sends data directly to indexers so you do not need to manage forwarders. Unless your deployment is in Splunk Cloud, you must manage the forwarders.
Last modified on 08 October, 2020
PREVIOUS
Introduction to the Splunk Add-on for Amazon Web Services
  NEXT
Source types for the Splunk Add-on for AWS

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters