Inno S3 Streaming Add-on

Stream AWS S3 logs into Splunk.
Deployed entirely from the Splunk UI.

The Inno S3 Streaming Add-on lets a Splunk administrator deploy an AWS Lambda function into the customer's own AWS account — no AWS console, no CLI — that streams S3 objects into Splunk over HTTP Event Collector (HEC) the moment they land.

Works with Splunk Cloud (Victoria) and Splunk Enterprise · AppInspect cloud-vetted · Air-gap friendly

See pricing

What it does

Deploy from Splunk

Configure AWS credentials and deployment settings in the Splunk UI. The add-on provisions the Lambda, IAM role, and S3 event trigger through the AWS API — no console clicking, no shell scripts.

S3 → Lambda → HEC

Every ObjectCreated event triggers a compiled, high-performance Lambda that gunzips NDJSON objects and streams events to your HEC endpoint — near-real-time ingestion at S3 scale.

Runs in your AWS account

Nothing passes through our servers. The Lambda runs inside the customer's own AWS account, and data flows directly from S3 to Splunk.

Credentials stored encrypted

AWS credentials are stored in Splunk's encrypted credential store (storage/passwords) — never in plain text.

Air-gapped & proxy support

Corporate proxy support for restricted egress, plus an exportable, self-contained deploy script for environments where Splunk has no direct AWS access.

Offline licensing

License keys are verified locally with RSA signatures — no phone-home, no activation server. Suitable for fully air-gapped Splunk deployments.

How it works

  1. Install the add-on on Splunk Cloud or a Heavy Forwarder / Splunk Enterprise instance.
  2. Enter your AWS credentials (stored encrypted) and your license key.
  3. Pick the S3 bucket, HEC endpoint, token, and index — then click Deploy.
  4. The add-on provisions the Lambda and S3 trigger in your AWS account. New objects start flowing into Splunk immediately.

Pricing

Most popular

Annual — 2 months free

$110 / year, per AWS account
  • Annual subscription license
  • Licensed per AWS account (node-locked)
  • All updates during the subscription term
  • Email support
  • 14-day money-back guarantee — Refund Policy
Buy annual — $110/yr

Monthly

$11 / month, per AWS account
  • Monthly subscription license
  • Licensed per AWS account (node-locked)
  • All updates while subscribed
  • Email support
  • Cancel anytime
Buy monthly — $11/mo

Buying opens a secure Paddle checkout. After purchase, reply to your receipt (or email support@innosw.net) with your AWS account ID — your license key is issued to it within 1 business day.

Need multiple AWS accounts, an enterprise agreement, or a proof-of-concept license? Get in touch.

Payments are processed by Paddle.com, our merchant of record. Applicable taxes/VAT are handled at checkout.

FAQ

Does my data pass through your servers?

No. The Lambda runs in your own AWS account and sends data directly to your Splunk HEC endpoint. Inno Software never sees your data.

Which Splunk versions are supported?

Splunk Cloud (Victoria Experience) and Splunk Enterprise 9.x with Python 3. The add-on passes Splunk AppInspect cloud checks.

What object formats are supported?

Gzip-compressed NDJSON (newline-delimited JSON) objects, the common output format of log shippers and EDR/security pipelines. Contact us about other formats.

Does licensing require internet access?

No. License keys are RSA-signed and verified locally — ideal for air-gapped environments. Keys are locked to your AWS account ID(s).

What happens when my subscription ends?

The license includes a grace period after expiry. After the grace period, ingestion stops until the license is renewed. Your deployed AWS resources remain under your control.