Amazon Kinesis Data Firehose
Developer Guide

Tutorial: Sending VPC Flow Logs to Splunk Using Amazon Kinesis Data Firehose

In this tutorial, you learn how to capture information about the IP traffic going to and from network interfaces in an Amazon Virtual Private Cloud (Amazon VPC). You then use Amazon Kinesis Data Firehose to send that information to Splunk. For more information about VPC network traffic, see VPC Flow Logs in the Amazon VPC User Guide.

The following diagram shows the flow of data that is demonstrated in this tutorial.


            Diagram
                showing data logs flowing from VPC to CloudWatch to Kinesis Data Firehose, then to AWS Lambda, then to
                Splunk.

As the diagram shows, first you send the Amazon VPC flow logs to Amazon CloudWatch. Then from CloudWatch, the data goes to a Kinesis Data Firehose delivery stream. Kinesis Data Firehose then invokes an AWS Lambda function to decompress the data, and sends the decompressed log data to Splunk.

Prerequisites

Before you begin, ensure that you have the following prerequisites: