Available CloudFormation and Terraform templates 🔗
To create Splunk-managed Metric Streams resources you can either use CloudFormation or a Terraform template.
Use CloudFormation to connect to Splunk Observability Cloud 🔗
You need to install the AWS integration first before you use any Cloudformation template. Learn more at Connect AWS to Splunk Observability Cloud.
Decide which CloudFormation template to use depending on your deployment method (for example, per AWS region or per AWS account) and integration type. Even if you don’t intend to use all options, you can safely deploy a CloudFormation template, since unused infrastructure doesn’t generate costs.
Caution
Splunk Log Observer is no longer available for new users. You can continue to use Log Observer if you already have an entitlement. To collect logs, see Send AWS logs to Splunk Platform.
Prepopulated CloudFormation templates 🔗
Select the QuickLink for a template which supports Metric Streams to open the AWS Management Console in the last region that you used.
Supports Metric Streams |
Deployment type |
QuickLink |
Hosted template |
|---|---|---|---|
Yes |
Once per account (using StackSets) |
Deploy this QuickLink |
|
Yes |
In each region |
Deploy this QuickLink in every region |
|
No |
Once per account (using StackSets) |
Deploy this QuickLink |
|
No |
In each region |
Deploy this QuickLink in every region |
|
Yes |
Once per account (using StackSets) |
Deploy this QuickLink |
|
Yes |
In each region |
Deploy this QuickLink in every region |
From the CloudFormation templates table, select the QuickLink for a template with support for metric streams. The QuickLink automatically opens the AWS Management Console in the last region you used, but you can select any other region in the AWS Management Console.
Custom CloudFormation templates 🔗
If none of the prepopulated CloudFormation templates meets your needs, you might create required resources using CloudFormation manually by following these steps:
Select the Hosted template link to download and modify the template you choose.
In the Quick Create stack dialog box for the selected template, enter the access token for your organization.
Select Create stack.
Use an API call to activate CloudWatch Metric Streams. To learn more, see Configure Metric Streams.
You can optionally use AWS CloudFormation StackSets to work simultaneously across multiple AWS regions after configuring the StackSet prerequisites for self-managed permissions. For more details, see Amazon Web Services documentation to configure StackSet prerequisites.
Use the Terraform template to connect to Splunk Observability Cloud 🔗
Alternatively, you can also deploy Kinesis Firehose with Terraform. See Terraform Setup for Creating Kinesis Firehose to Send CloudWatch Metric Stream .
The provided Terraform template supports Metric Streams only, and does not offer log support.