Federated Search 2.0 Demo

Splunk-side

AWS Account ID
889918306825
Region
us-east-1
IAM Role ARN
arn:aws:iam::889918306825:role/SplunkFederatedAnalytics
CSV File S3 URI
s3://logs-collected-depot-889918306825-us-east-1/firewall_logs_demo.csv
CloudTrail Logs S3 URI
s3://aws-logs-889918306825-us-east-1/cloudtrail/AWSLogs
VPC Flow Logs Bucket S3 URI
s3://aws-logs-889918306825-us-east-1/vpc-flow-logs/AWSLogs
Glue Database
cisco-firewall-logs
Glue Table
logs-collected-depot

AWS-side

Automatic

Enter Splunk Cloud details to fetch inputs automatically.

Inputs

Resulting Policy

{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::262326168930:role/federation-proxy-role"
  },
  "Action": "sts:AssumeRole",
  "Condition": {
    "StringEquals": {
      "sts:ExternalId": "{splunk_co2_stack}"
    }
  }
}