Stream AWS S3 logs into Splunk.
Deployed in minutes, from the Splunk UI.
The Inno Streaming Add-on for AWS S3 lets a Splunk administrator deploy a serverless AWS Lambda into the customer's own AWS account — no AWS console, no CLI, no Heavy Forwarders — that streams S3 objects into Splunk over HTTP Event Collector (HEC) the moment they land.
Flat $11/month — unlimited ingest volume · Serverless, no Heavy Forwarders · AWS keys never stored in Splunk · AppInspect cloud-vetted · Splunk Cloud & Enterprise
See pricingWhat it does
One-click deploy from the Search Head
Install on your Splunk Search Head, fill in a short form, and click Deploy. The add-on provisions the Lambda, its IAM role, and the S3 event trigger for you through the AWS API — no console clicking, no CloudFormation, no shell scripts.
Event-driven: S3 → Lambda → HEC
Every ObjectCreated event triggers a compiled Go Lambda that streams,
gunzips, and batches NDJSON straight to your HEC endpoint. No polling, no queue latency —
events land in Splunk within seconds.
Runs entirely in your AWS account
Nothing passes through our servers. The Lambda runs inside the customer's own AWS account and data flows directly from S3 to your Splunk — Inno Software never sees it.
AWS keys are never stored in Splunk
Your AWS credentials are used only at deploy time to create the resources — then the add-on auto-wipes them (a default "delete credentials after deploy" option), and you can clear them yourself at any time. The running Lambda authenticates with its own least-privilege IAM role, so no long-lived AWS keys are ever retained in Splunk.
Serverless — no forwarder fleet
No Heavy Forwarders to size, run 24/7, or patch. Lambda scales with your data and back to zero when idle — AWS runs it for you, and you pay only for what you ingest.
Battle-tested, secure & air-gap ready
A compiled Go binary (source not shipped), corporate-proxy support, an exportable self-contained deploy script, and fully offline RSA license verification — no phone-home. Extensively benchmarked for stability at scale (see below).
Deploy in three steps
No AWS expertise required. A Splunk admin can go from install to live ingestion in about ten minutes.
- Install on your Search Head. The add-on is a management console, not a data-collection node — data flows S3 → Lambda → HEC directly, so it belongs on the Search Head where admins work, not on a Heavy Forwarder. Works on Splunk Cloud (Victoria) and Splunk Enterprise alike.
- Fill in the form. AWS credentials (used once, then wiped), your license key, and the target: S3 bucket, HEC endpoint, token, and index.
- Click Deploy. The add-on builds the Lambda, IAM role, and S3 trigger in your account. New objects start flowing into Splunk immediately — and you can preview or export the exact deployment plan first.
Performance & scaling
At the recommended 1769 MB memory setting, each Lambda invocation forwards 1.23 TB/day (14.2 MB/s), and throughput scales linearly with reserved concurrency — so you simply set concurrency to match your target, from a few TB/day to petabyte-scale, without adding any servers. And whatever volume you scale to, the license stays a flat $11/month — there are no per-GB or per-event fees.
| Target throughput (1769 MB, gzip on) | Reserved concurrency |
|---|---|
| 10 TB/day | 9 |
| 100 TB/day | 82 |
| 500 TB/day | 408 |
| 1,000 TB/day | 816 |
Prefer not to tune anything? The out-of-the-box default (512 MB memory, concurrency 20) delivers ≈ 7 TB/day with zero configuration. Raising memory to 1769 MB makes each invocation ~3.5× faster, so higher targets need far less concurrency (the table above).
Benchmark: controlled forwarding test (128 MiB objects, us-east-1), gzip-on measurements only. The synthetic test data compressed ~3.7× under gzip (high-entropy hashes/UUIDs); real-world security logs compress ~8–10×, so egress savings in production are even greater. End-to-end throughput is ultimately bounded by your Splunk indexing tier — the add-on itself is not the limiting factor.
Pricing
Effectively unlimited S3 ingestion — for a flat $11/month.
Our license is one flat price per AWS account: $11/month, or $110/year. There are no per-GB, per-event, or per-ingest fees — ever. Stream 1 GB/day or scale Lambda concurrency to petabytes per day — you pay Inno Software the exact same $11. Throughput scales linearly and is bounded only by your AWS concurrency quota and your Splunk indexing tier, not by us.
The only volume-based cost is the AWS Lambda compute you use directly (≈ $0.002/GB, paid to AWS) — there is no metered charge from us on top of the flat license.
Annual — 2 months free
- Unlimited ingest volume — no per-GB fees
- Licensed per AWS account (node-locked)
- All updates during the subscription term
- Email support
- Cancel anytime before renewal
Monthly
- Unlimited ingest volume — no per-GB fees
- Licensed per AWS account (node-locked)
- All updates while subscribed
- Email support
- Cancel anytime
Buying opens a secure Paddle checkout. After purchase, reply to your receipt (or email support@innosw.net) with your AWS account ID — your license key is issued to it within 1 business day.
Need multiple AWS accounts, an enterprise agreement, or a proof-of-concept license? Get in touch.
Payments are processed by Paddle.com, our merchant of record. Applicable taxes/VAT are handled at checkout.
FAQ
Where should I install the add-on?
On your Search Head. The add-on is a management/deployment console — it does not collect data itself, so it does not belong on a Heavy Forwarder. Once deployed, data flows S3 → Lambda → HEC directly to your indexers, independent of the add-on. Works on Splunk Cloud (Victoria) and Splunk Enterprise.
Are my AWS credentials stored in Splunk?
No long-lived keys are retained. Credentials are needed only at deploy time to create the AWS resources; the add-on wipes them automatically after a successful deploy (on by default) and you can clear them manually at any time. The deployed Lambda runs on its own least-privilege IAM role, not on your keys.
Does my data pass through your servers?
No. The Lambda runs in your own AWS account and sends data directly to your Splunk HEC endpoint. Inno Software never sees your data.
Which Splunk versions are supported?
Splunk Cloud (Victoria Experience) and Splunk Enterprise 9.x with Python 3. The add-on passes Splunk AppInspect cloud checks.
What object formats are supported?
Compression — gzip (.gz) or uncompressed; detected
automatically, no configuration.
Structure — newline-delimited (one record per line). Two record types are handled per line, and both can appear in the same object:
- JSON objects (NDJSON / JSON Lines) → indexed as structured JSON; the configured time and host fields are lifted into Splunk metadata.
- Plain-text lines (syslog, CSV,
key=value, or any line-based log) → indexed as string events, exactly as written. No line is dropped.
Typical sources — Kinesis Firehose, CloudTrail, VPC Flow Logs, GuardDuty, ALB/CloudFront access logs, and most EDR/security and application log shippers.
Not yet supported (contact us) — other compression codecs (zstd, bzip2, zip), whole-file JSON arrays, columnar/binary formats (Parquet, Avro, ORC), and multiline-per-event logs.
Does licensing require internet access?
No. License keys are RSA-signed and verified locally — ideal for air-gapped environments. Keys are locked to your AWS account ID(s).
What happens when my subscription ends?
The license includes a grace period after expiry. After the grace period, ingestion stops until the license is renewed. Your deployed AWS resources remain under your control.