Announcing Splunk Federated Search for Amazon S3 Now Generally Available in Splunk Cloud Platform

Splunk is pleased to announce the general availability of Federated Search for Amazon S3, a new capability that allows customers to search data from their Amazon S3 buckets directly from Splunk Cloud Platform without the need to ingest it.

Enterprises rely heavily on cloud object storage services as the de facto destination for their new data to leverage the cost, compliance, security, scalability and manageability benefits that cloud platforms can offer. Amazon S3 is one of the largest services available today, with over 280 Trillion objects all over the world. However, one of the biggest concerns when using cloud storage solutions is data movement, since it can introduce latency and egress costs when attempting to search that data.

To address this challenge, Splunk users can now search data at rest within their Amazon S3 buckets directly from their Splunk Cloud Platform stack, ideal for investigations that require as-needed access to historical, archival, or low-value data. What’s more, you can still run SPL searches, create dashboards, reports, and correlate data between Amazon S3 and Splunk.

It is important to note that data that requires real-time search performance and high access frequency should still be accessed using Splunk Search on indexed data.

Federated Search for Amazon S3 is supported via an integration with AWS Glue Data Catalog, which provides the schema and metadata necessary to read compatible datasets from Amazon S3. AWS Glue Data Catalog tables provide the necessary schema that Splunk Cloud Platform needs to make sense of the data stored in Amazon S3. This also allows Splunk to search popular data formats such as JSON, CSV, Parquet, XML, ORC and more!

In turn, this integration enables Splunk Admins and users to benefit from the following use cases:

  1. Perform forensic investigations directly on historical data stored in Amazon S3 at rest.
  2. Run large statistics searches over historical data in Amazon S3.
  3. Leverage Amazon S3 as part of their data tiering strategy to store data outside of retention period.

Federated Search for Amazon S3 is available for Splunk Cloud Platform stacks hosted on AWS running on version 9.0.2305. Access to Federated Search for Amazon S3 requires a Data Scan Units license for your Splunk Cloud Platform stack. Contact your Splunk sales representative to learn more about this.

For more about Federated Search for Amazon S3, check out the documentation and release notes, dig into our validated architectures, and tune into our webinar on how to seamlessly search your data with Splunk and AWS.

/en_us/blog/fragments/digital-resilience-pays-off
Style
two-column

Related Articles

Exploratory Data Analysis for Anomaly Detection
Platform
4 Minute Read

Exploratory Data Analysis for Anomaly Detection

With great choice comes great responsibility. One of the most frequent questions we encounter when speaking about anomaly detection is how do I choose the best approach for identifying anomalies in my data? The simplest answer to this question is one of the dark arts of data science: Exploratory Data Analysis (EDA).
Splunk at the Service of Medical Staff
Platform
3 Minute Read

Splunk at the Service of Medical Staff

Given the current circumstances and the pressure medical staff and hospitals are facing in general, access to information is now more critical than ever. Optimising the process of medical exams and enabling alerts and notifications in real-time has become essential.
A Picture is Worth a Thousand Logs
Platform
3 Minute Read

A Picture is Worth a Thousand Logs

Splunk can be used to ingest machine-learning service information from services like AWS recognition, what does that look like and how can you set it up?
Bringing You Context-Driven, In-Product Guidance
Platform
1 Minute Read

Bringing You Context-Driven, In-Product Guidance

Splunk is providing in-product guidance right at your fingertips to help you accomplish your goals without navigating away from the product. Learn more in this blog post.
Splunk AR: HoloLens and Unity SDK
Platform
2 Minute Read

Splunk AR: HoloLens and Unity SDK

Get a sneak peek on two private beta products — AR app for HoloLens, a solution for a hands-free experience, and a Splunk SDK to allow you to securely incorporate Splunk data into your custom apps.
Threat Hunting With ML: Another Reason to SMLE
Platform
4 Minute Read

Threat Hunting With ML: Another Reason to SMLE

This blog is the first in a mini-series of blogs where we aim to explore and share various aspects of our security team’s mindset and learnings. In this post, we will introduce you to how our own security and threat research team develops the latest security detections using ML.
Creating a Fraud Risk Scoring Model Leveraging Data Pipelines and Machine Learning with Splunk
Platform
8 Minute Read

Creating a Fraud Risk Scoring Model Leveraging Data Pipelines and Machine Learning with Splunk

One of the new necessities we came across several times was that the clients were willing to get a sport bets fraud risk scoring model to be able to quickly detect fraud. For that purpose, I designed a data pipeline to create a sport bets fraud risk scoring model based on anomaly detection algorithms built with Probability Density Function powered by Splunk’s Machine Learning Toolkit.
Levelling up your ITSI Deployment using Machine Learning
Platform
2 Minute Read

Levelling up your ITSI Deployment using Machine Learning

To help our customers extract the most value from their IT Service Intelligence (ITSI) deployments, Splunker Greg Ainslie-Malik created this blog series. Here he presents a number of techniques that have been used to get the most out of ITSI using machine learning.
Smarter Noise Reduction in ITSI
Platform
8 Minute Read

Smarter Noise Reduction in ITSI

How can you use statistical analysis to identify whether you have an unusual number of events, and how can similar techniques be applied to non-numeric data to see if descriptions and sourcetype combinations appear unusual? Read all about it in this blog.
/en_us/blog/fragments/about-splunk
/en_us/blog/fragments/subscribe-footer