Implementation Guide: Splunk Grand Central Integration for Control Tower
Splunk can also be deployed using the AWS Marketplace AMI that is running version 7.2 or better. Amazon Kinesis Data Firehose must be able to access the Splunk HTTP Event Collector (HEC) and requires the endpoint to be a publicly facing URL with a valid SSL Certificate (not self-signed). The Data Input associated