Splunk® App for Infrastructure

Administer Splunk App for Infrastructure

Download manual as PDF

Download topic as PDF

Configure AWS data collection for Splunk App for Infrastructure

Admin privileges are required to configure data collection.

To collect data and monitor your AWS accounts, add your AWS account information to the Splunk App for Infrastructure (SAI) and collect data from your entities such as EC2, EBS, ELB, and CloudWatch logs. For more information about these AWS metrics, see:

After you add AWS data and validate new entities are connected, start monitoring your infrastructure from the Investigate tab of SAI. You can group your entities to monitor them more easily, and drill down into the Analysis Workspace to further analyze your infrastructure.

Prerequisites

  • AWS Add-on version 4.5. For more information, see Splunk Add-on requirements.
  • If configuring on an on-premises instance, you need your AWS account Name, Key ID, and Secret Key information for Step 1.
  • If configuring on an AWS EC2 instance, you need to configure an IAM role for AWS data collection in Step 1.

Steps

Step 1: Connect to your AWS account

For on-premises instances:

  1. In the SAI user interface, click the Add Data tab.
  2. In the left panel click AWS.
  3. Enter a Name to identify an AWS account.
  4. Enter the account's Key ID and Secret Key, and select a Region Category.
  5. Click Add AWS account.

For AWS EC2 instances:

  1. In the SAI user interface, click the Add Data tab.
  2. In the left panel click AWS.
  3. Attach IAM role. Click the instructions link for directions for how to attach an IAM role needed for AWS data collection, or see Configure Identity and Access Management (IAM) permissions for AWS data collection. There can be only one IAM role attached to an instance, and the user interface updates when the IAM role is detected.
  4. Click Verify IAM role attachment. A green checkmark and an identified IAM detected role display.

Step 2: Collect data from AWS

  1. Select the AWS Entity Types you want to collect data from.
  2. Select the AWS Regions that apply.
  3. If you want to collect data from CloudWatch Logs, select Yes and click Add AWS data source.
    • When setting up CloudWatch Logs agent configuration in AWS, edit the log stream name (log_stream_name) with a unique name (instance_id) for each log group within the configuration file. This defines the log stream's identity for correlation of logs to individual instances and metric data. For example:
    [/var/log/messages]
    file = /var/log/messages
    log_group_name = /var/log/messages
    log_stream_name = {instance_id}
    
    • Select the region and enter the log file name. Click the Add to add more log files.
  4. Click Update AWS data source.

Step 3: Once your AWS account is added, verify your data connection

  1. When a connection is made to your AWS account(s), connected entities display.
    • If no new entities are connected after a few minutes, click Refresh.
    • When new entities are connected, click Take a look now to view your host.
PREVIOUS
Configure OpenShift data collection for Splunk App for Infrastructure
  NEXT
Configure Identity and Access Management (IAM) policy for AWS data collection

This documentation applies to the following versions of Splunk® App for Infrastructure: 1.3.0, 1.3.1, 1.4.0, 1.4.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters