Configure inputs

Configure inputs so that Splunk Add-on for CloudTrail can collect your data.

Best practices for configuring inputs

• Configure Simple Queue Service (SQS)-based S3 inputs to collect AWS data.
• Configure an AWS Config input for the Splunk Add-on for Amazon Web Services on your data collection node through Splunk Web. This data source is available only in a subset of AWS regions, which does not include China. See http://docs.aws.amazon.com/general/latest/gr/rande.html#awsconfig_region for a full list of supported regions.
• Configure a single enabled Config modular input for each unique SQS. Multiple enabled modular inputs can cause conflicts when trying to delete SQS messages or S3 records that another modular input is attempting to access and parse.
• Disable or delete testing configurations before releasing your configuration in production.

Configure AWS services for the Config input

The Splunk Add-on for AWS collects events from a SQS that subscribes to the Simple Notification Service (SNS) notification events from AWS Config. Configure AWS Config to produce SNS notifications, and then create the SQS that the add-on can access. See http://aws.amazon.com/config/.

1. Enable AWS Config. See http://docs.aws.amazon.com/config/latest/developerguide/setting-up.html.
2. Specify a new S3 bucket to save the data and an SNS Topic to which Splunk software streams Config notifications. Do not use an existing bucket or SNS.
3. Verify that you completed the setup process. If you used the AWS console, the Resource Lookup page displays.
4. Create a new SQS.
5. Subscribe the SQS exclusively to the SNS Topic that you created.
6. Grant IAM permissions to access the S3 bucket and SQS to the AWS account that the add-on uses to connect to your AWS environment.

Set up a Config input using Splunk Web

In Splunk Web, click on Splunk Add-on for AWS in the left navigation bar, then click Create New Input > Config > Config. Use the information in the following table to help you configure the fields for an AWS Config input on your data collection node.

Argument in configuration file	Field in Splunk Web	Description	Action
aws_account	AWS Account	The AWS account or EC2 IAM role the Splunk platform uses to access your Config data.	In Splunk Web, select an account from the drop-down list. In inputs.conf, enter the name of one of the AWS accounts that you configured on the Configuration page or the name of the autodiscovered EC2 IAM role.
aws_region	AWS Region	The AWS region that contains the log notification SQS queue. See the AWS documentation for more information.	In inputs.conf, enter the region ID.
sqs_queue	SQS queue name	The name of the queue to which AWS sends new Config notifications. The queue name is the final segment of the full queue URL. For example, if your SQS queue URL is http://sqs.us-east-1.amazonaws.com/123456789012/testQueue, then your SQS queue name is testQueue.	If your service account has appropriate permissions, Splunk Web lets you select your queue from the drop-down list. Otherwise, enter the queue name manually.
sourcetype	Source type	Event extraction relies on the default value of source type. If you change the default value, you must update props.conf as well. The Splunk platform indexes AWS Config events using three variations of this source type, as follows: Configuration snapshots are indexed as sourcetype=aws:config. Configuration change notifications are indexed as sourcetype=aws:config:notification Logs from aws_config.log are indexed as sourcetype=aws:config:log	Enter a value only if you want to override the default of aws:config. If you modify the default value of aws:config, you see <yourcustomsourcetype>:notification and <yourcustomsourcetype>:log.
index	Index	The index name where the Splunk platform puts the Config data. The default is "main".	Optionally change the index name where the Splunk platform will put the Config data.
Polling interval	Interval	The number of seconds for the Splunk platform to wait before it runs the command again. The default value is 30 seconds.	Optionally change the polling interval, in seconds.

Switch from a Config input to an SQS-based S3 input

The SQS-based S3 input is a more fault-tolerant and higher-performing alternative to the Config input for collecting CloudTrail data. If you are already collecting Config data using a Config input, you can configure an SQS-based S3 input and seamlessly switch to the new input for Config data collection with little disruption.

1. Disable the Config input you are using to collect Config data.
2. Set up a dead-letter queue and the SQS visibility timeout setting for the SQS queue from which you are collecting Config data.
3. Create an SQS-based S3 input, pointing to the SQS Queue you configured in the last step.

Once configured, the new SQS-based S3 input replaces the old Config input to collect Config data from the same SQS queue.