AWS::KinesisFirehose::DeliveryStream SplunkDestinationConfiguration

The SplunkDestinationConfiguration property type specifies the configuration of a destination in Splunk for a Kinesis Data Firehose delivery stream.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

JSON

{
  "BufferingHints" : SplunkBufferingHints,
  "CloudWatchLoggingOptions" : CloudWatchLoggingOptions,
  "HECAcknowledgmentTimeoutInSeconds" : Integer,
  "HECEndpoint" : String,
  "HECEndpointType" : String,
  "HECToken" : String,
  "ProcessingConfiguration" : ProcessingConfiguration,
  "RetryOptions" : SplunkRetryOptions,
  "S3BackupMode" : String,
  "S3Configuration" : S3DestinationConfiguration,
  "SecretsManagerConfiguration" : SecretsManagerConfiguration
}

YAML

  BufferingHints: 
    SplunkBufferingHints
  CloudWatchLoggingOptions: 
    CloudWatchLoggingOptions
  HECAcknowledgmentTimeoutInSeconds: Integer
  HECEndpoint: String
  HECEndpointType: String
  HECToken: String
  ProcessingConfiguration: 
    ProcessingConfiguration
  RetryOptions: 
    SplunkRetryOptions
  S3BackupMode: String
  S3Configuration: 
    S3DestinationConfiguration
  SecretsManagerConfiguration: 
    SecretsManagerConfiguration

Properties

BufferingHints

The buffering options. If no value is specified, the default values for Splunk are used.

Required: No

Type: SplunkBufferingHints

Update requires: No interruption

CloudWatchLoggingOptions

The Amazon CloudWatch logging options for your Firehose stream.

Required: No

Type: CloudWatchLoggingOptions

Update requires: No interruption

HECAcknowledgmentTimeoutInSeconds

The amount of time that Firehose waits to receive an acknowledgment from Splunk after it sends it data. At the end of the timeout period, Firehose either tries to send the data again or considers it an error, based on your retry settings.

Required: No

Type: Integer

Minimum: 180

Maximum: 600

Update requires: No interruption

HECEndpoint

The HTTP Event Collector (HEC) endpoint to which Firehose sends your data.

Required: Yes

Type: String

Minimum: 0

Maximum: 2048

Update requires: No interruption

HECEndpointType

This type can be either Raw or Event.

Required: Yes

Type: String

Allowed values: Raw | Event

Update requires: No interruption

HECToken

This is a GUID that you obtain from your Splunk cluster when you create a new HEC endpoint.

Required: No

Type: String

Minimum: 0

Maximum: 2048

Update requires: No interruption

ProcessingConfiguration

The data processing configuration.

Required: No

Type: ProcessingConfiguration

Update requires: No interruption

RetryOptions

The retry behavior in case Firehose is unable to deliver data to Splunk, or if it doesn't receive an acknowledgment of receipt from Splunk.

Required: No

Type: SplunkRetryOptions

Update requires: No interruption

S3BackupMode

Defines how documents should be delivered to Amazon S3. When set to FailedEventsOnly, Firehose writes any data that could not be indexed to the configured Amazon S3 destination. When set to AllEvents, Firehose delivers all incoming records to Amazon S3, and also writes failed documents to Amazon S3. The default value is FailedEventsOnly.

You can update this backup mode from FailedEventsOnly to AllEvents. You can't update it from AllEvents to FailedEventsOnly.

Required: No

Type: String

Allowed values: FailedEventsOnly | AllEvents

Update requires: No interruption

S3Configuration

The configuration for the backup Amazon S3 location.

Required: Yes

Type: S3DestinationConfiguration

Update requires: No interruption

SecretsManagerConfiguration

The configuration that defines how you access secrets for Splunk.

Required: No

Type: SecretsManagerConfiguration

Update requires: No interruption

See also

• SplunkDestinationConfiguration in the Amazon Kinesis Data Firehose API Reference .