Data Manager

User Manual

Onboard AWS in Data Manager

Data Manager helps you quickly set up multiple AWS accounts for data ingestion into your Splunk Cloud deployment.

Logging in and getting started with Data Manager

Complete the following steps to get started:

  1. Log into Splunk Cloud using Splunk-provided credentials.
  2. Save the email that contains the credentials. It contains a Forgot Password link, in case you need to reset your password.
  3. Change your password at the prompt.
  4. Sign the terms and conditions.
  5. Start onboarding or take the product tour.

Data Manager walks you through adding existing data sources so that you can monitor and investigate any alerts that impact the security state of your environment. It also helps you to see which services you are ingesting, but not yet using, so that you can expand your security coverage.


Stages of onboarding

Data Manager walks you through various stages depending if you're onboarding a single AWS account or multiple AWS accounts.

The onboarding steps are described in detail within Data Manager. The details are not duplicated here. Wait for each step to finish, before attempting to continue on to the next step.

Onboard a single account for push-based data ingestion

Onboarding a single AWS account consists of the following stages:

  1. Configure the AWS prerequisites in the data account.
  2. Configure the data account, regions, and data sources.
  3. Create a data ingestion CloudFormation stack in each region.

This image shows an example of a single account onboarding flow.

Onboard multiple accounts for push-based data ingestion

Onboarding multiple AWS accounts consists of the following stages:

  1. Configure the AWS prerequisites in the control account and data accounts.
  2. Configure the control account, data accounts, regions, and data sources.
  3. Create a control account CloudFormation StackSet to manage the data accounts.
  4. Create data account CloudFormation stack instances per region.

This image shows an example of a multiple account onboarding flow.

Onboard a single account for pull-based data ingestion

Onboarding a single AWS account consists of the following stages:

  1. AWS Admin completes the setup prerequisites in the data account
  2. Input AWS SQS Queue ARNs, Data Account IDs, and S3 bucket names.
  3. Establish an IAM role for SQS queue reads, and S3 bucket reads.
  4. Summary

This image shows an example of a single account onboarding flow for AWS S3 data input types.

Last modified on 05 September, 2024
Prerequisites for onboarding AWS data sources   About CloudFormation stack templates

This documentation applies to the following versions of Data Manager: 1.11.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters