All Apps and Add-ons

Process AWS VPC Flow Logs before indexing.

alonsocaio
Contributor

Hello,

I am sending AWS VPC Flow logs to Splunk using the Splunk App for AWS and and I'm using the SQS based inputs. Since VPC Flow logs are generating a huge amount of data, I'd like to do some processing on these logs before sending it to the indexers.

Does anyone have any idea on how to perform some flow aggregation, for logs containing same src address/port, dest address/port, interface id and account id within a time range? Or have you needed to use another way to reduce the amount of logs received from VPC Flow?

I'm also planning to send VPC Flow logs using Kinesis Firehose.

0 Karma
1 Solution

alonsocaio
Contributor

I have decided to use an external tool, such as Cribl, to perform VPC Flow aggregation.

View solution in original post

Gene
Path Finder

Nice promotion of Cribl 🙂

I have heard only good things about it, will need to check.

Good luck and happy splunking!

 

0 Karma

alonsocaio
Contributor

I have decided to use an external tool, such as Cribl, to perform VPC Flow aggregation.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...