Configure inputs for the Splunk Add-on for AWS
Best practices for configuring inputs
- Configure SQS-based S3 inputs to collect AWS data.
- Configure an AWS Config input for the Splunk Add-on for Amazon Web Services on your data collection node through Splunk Web. This data source is only available in a subset of AWS regions, which does not include China. See the AWS documentation for a full list of supported regions.
- Configure a single enabled Config modular input for each unique SQS. Multiple enabled modular inputs can cause conflicts when trying to delete SQS messages or S3 records that another modular input is attempting to access and parse.
- Be sure to disable or delete testing configs before releasing your configuration in production.
Input configuration overview
You can use the Splunk Add-on for AWS to collect data from AWS. For each supported data type, one or more input types are provided for data collection.
Follow these steps to plan and perform your AWS input configuration:
Users adding new inputs must have the
admin_all_objects role enabled.
- Click input type to go to the input configuration details.
- Follow the steps described in the input configuration details to complete the configuration.
Download and install Trumpet
Trumpet is a configuration tool that leverages AWS CloudFormation to set up AWS infrastructure. This infrastructure pushes data to your Splunk platform instance using the HTTP Event Collector (HEC).
To install and configure Trumpet, see the README file on Github.
Configure a Config input using Splunk Web
To configure inputs using Splunk Web, click Splunk Add-on for AWS in the left navigation bar on Splunk Web home, then click Create New Input > Config > Config. Fill out the fields as described in the table:
|Field in Splunk Web||Description|
|AWS Account||The AWS account or EC2 IAM role the Splunk platform uses to access your Config data. In Splunk Web, select an account from the drop-down list.|
|AWS Region||The AWS region that contains the log notification SQS queue. Enter the region ID. See the AWS documentation for more information.|
|SQS queue name|| The name of the queue to which AWS sends new Config notifications. Select a queue from the drop-down list, or enter the queue name manually. The queue name is the final segment of the full queue URL. For example, if your SQS queue URL is |
|Source type|| A source type for the events. Enter a value only if you want to override the default of |
Note that the Splunk platform indexes AWS Config events using three variations of this source type:
|Index||The index name where the Splunk platform puts the Config data. The default is main.|
|Interval||The number of seconds to wait before the Splunk platform runs the command again. Default is 30 seconds.|
Configure a Config input using configuration files
To configure inputs manually in
inputs.conf, create a stanza using the following template and add it to
$SPLUNK_HOME/etc/apps/Splunk_TA_aws/local/inputs.conf. If the file or path does not exist, create it.
[aws_config://<name>] aws_account = <value> aws_region = <value> sqs_queue = <value> interval = <value> sourcetype = <value> index = <value>
Some of these settings have default values that can be found in
[aws_config] aws_account = sourcetype = aws:config queueSize = 128KB persistentQueueSize = 24MB interval = 30
The values above correspond to the default values in Splunk Web as well as some internal values that are not exposed in Splunk Web for configuration. If you choose to copy this stanza to
/local and use it as a starting point to configure your
inputs.conf manually, change the stanza title from
aws_config://<name> and add the additional parameters that you need.
Configure data collection on your Splunk Enterprise instance
This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.3.0, 7.3.1, 7.3.2