CloudWatch logs via HEC on Splunk Light Cloud?

[trauts2]

This article shows how I was hoping to ingest our CloudWatch logs https://www.splunk.com/blog/2017/02/03/how-to-easily-stream-aws-cloudwatch-logs-to-splunk.html

But after installing the AWS into Splunk Light Cloud, the instructions don't match up. Is there a more recent and comprehensible instruction for configuring Splunk Light to consume logs in CloudWatch? I was surprised at how difficult this is, which makes me think I haven't found the right docs yet.

Thanks!

[gneumann_splunk · Accepted solution]

Here are some resources to help you with your configuration:

Splunk Light documentation to configure App and Add-on for AWS in Splunk Light cloud service.
- Do your AWS planning, and configure services and permissions in AWS
- Configure Splunk Light, paying particular attention to Step 3 for setting up Splunk Light:
http://docs.splunk.com/Documentation/SplunkLight/7.0.1/Installation/GettingstartedSplunkAppforAWS

YouTube Videos you can watch that provide great information about configuring AWS services and permissions:
- Splunk App for AWS configuration & AWS prep walkthrough:
https://www.youtube.com/watch?v=U_esFvx6GHY
- Click Show More to see CloudWatch specific info:
https://www.youtube.com/watch?v=U_esFvx6GHY&feature=youtu.be&t=1673

Hoping this info gets you up and running.