terraform

In this blog post, we will learn how to ingest VPC flow logs with additional metadata into Splunk. We will start by creating a VPC flow log using Terraform and pushing the logs to S3. From S3, we will ingest these logs into Splunk using SQS. Finally, we will make some changes to Splunk’s props.conf file for correct field extraction of the additional VPC flow log fields. All Terraform files are available to download at my GitHub Repo....

This blog post will walk you through setting up a Splunk environment on AWS for lab purposes using the Splunk Enterprise Free 60-day trial. After 60 days you can convert to a perpetual free license or purchase a Splunk Enterprise license to continue using the expanded functionality designed for enterprise-scale deployments. There is an indexing limit of 500 MB/Day which will be more than enough for our demo purposes. There are multiple ways to accomplish this - using the AWS Console, the CLI or CloudFormation....