Inno S3 Streaming Add-on for AWS S3

Inno Streaming Add-on for AWS S3 lets a Splunk administrator deploy a serverless ingestion pipeline into their own AWS account directly from the Splunk UI — no AWS console, no aws CLI, and no forwarder in the data path. The problem: getting S3 data into Splunk usually means standing up and maintaining polling-based inputs or Heavy Forwarders, granting broad AWS access, and paying for idle infrastructure. This add-on replaces that with an event-driven, in-account design. How it works: you enter your AWS credentials (stored encrypted in Splunk), your HEC endpoint, target index, and S3 bucket, then click Deploy. Using the AWS API (boto3), the add-on provisions a least-privilege IAM role, a compiled Go Lambda, and an S3 ObjectCreated notification. From then on, every object that lands in the bucket triggers the Lambda, which streams and decompresses the object and forwards the records to your Splunk HEC endpoint in real time. Data flows S3 → Lambda → HEC entirely inside your AWS account; it never passes through the vendor. Highlights: - Deploy from the Splunk UI in minutes; idempotent re-deploys. - Event-driven and serverless — the Lambda scales with your data and back to zero when idle. - Installs on Splunk Cloud search heads and on Splunk Enterprise / Heavy Forwarders. - AWS keys are only needed at deploy time and are auto-wiped after a successful deploy; the Lambda runs on its own IAM role. - Compression auto-detected from the content, not the file name: gzip, zstd, bzip2 or uncompressed — all streamed, so memory does not grow with object size. - Two object layouts, auto-detected: * line-oriented — NDJSON / JSON Lines and plain-text logs (syslog, CSV, key=value, ALB / CloudFront access logs, VPC Flow Logs, S3 access logs). One line, one event. * JSON envelope {"Records":[...]} and bare JSON arrays — CloudTrail, AWS Config, GuardDuty. One event per element, streamed element by element, so a CloudTrail file with 100k records never lands in memory at once. - Routing table: map key prefixes to their own index and sourcetype, so one deployment feeds many log types. A route can post to HEC /raw and reuse the sourcetypes the Splunk Add-on for AWS already ships for line breaking and field extraction. - Compiled Go Lambda binary, corporate-proxy support, and an air-gapped export option for Splunk hosts with no AWS connectivity. Requires an HEC endpoint reachable from AWS Lambda and a token whose allowed indexes cover your target index. The add-on is free to install. A license key is required to preview, export or deploy; keys are node-locked to your AWS account id and verified entirely offline. See detailed performance-benchmark results (measured S3-to-HEC throughput and tuning), step-by-step usage guides, full documentation, and licensing at https://innosw.net - 11 USD / month - 110 USD / year