Splunk Cloud Data Manager

Splunk Cloud Data Manager

Splunk Cloud Data Manager is a great way to get data in from a single or small number of AWS accounts. Comprehensive documentation on how to use SCDM can be found here: https://docs.splunk.com/Documentation/DM/1.4.1/User/About .

However, there are a number of pre-requisite steps with no reference CloudFormation. CloudFormation templates that can be used to enable these servers can be found here: https://github.com/splunk/splunk-aws-gdi-toolkit/tree/main/Single%20Account%20CloudFormation .

Full instructions on how to deploy these templates and enable the necessary settings in Splunk can be found here.