Use AWS Lambda with HTTP Event Collector

In cooperation with Amazon, Splunk is pleased to provide a built-in AWS Lambda Node.js blueprint for HTTP Event Collector (HEC). The blueprint makes it easy to get started quickly, sending events from AWS Lambda to HEC running on Splunk Cloud. You can also write a Lambda function from scratch, either in JavaScript using Node.js or in Java.

Note: Be careful when sending data from AWS to an on-premises Splunk Enterprise instance. Sending large amounts of data "out" of AWS may result in excessive egress cost and latency.

AWS Lambda is an Amazon Web Services compute service that runs your back-end code in response to events and manages compute resources for you. The code running on AWS Lambda is called a Lambda function. It can be provided either as code that you write in the integrated editor within the AWS management console, or, if your code requires custom libraries, as a .ZIP file containing all necessary components that you upload. You can also select from pre-built samples, or blueprints. Code can be written in JavaScript using Node.js or in Java.

A Lambda function contains code, dependencies, and configuration information. Configuration includes information like the handler that will receive the event, the AWS Identity and Access Management (IAM) role that AWS Lambda can use to execute the Lambda function, the compute resource that should be allocated and an execution timeout. For general information about AWS Lambda, see

AWS Lambda can receive event data from Amazon Kinesis, Amazon DynamoDB, Amazon S3, and other Amazon services, and then send it on to HEC. You can collect the data using HEC in Splunk Cloud, which also runs on AWS, or in Splunk Enterprise on-premises.

Diagram illustrating AWS services pointing to AWS Lambda pointing to HTTP Event Collector.

Note: As in Splunk Enterprise, HTTP Event Collector is disabled by default in Splunk Cloud. If you will be using HEC to get data into Splunk Cloud, you will need to enable the feature first. Managed Splunk Cloud customers must open a ticket with Splunk Support to enable HEC.

The next several topics discuss creating your own Lambda functions:

More information