[Logs] Document Splunk AWS add-on R2 credential limitation#31274
[Logs] Document Splunk AWS add-on R2 credential limitation#31274rianvdm wants to merge 1 commit into
Conversation
|
This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:
|
Review
Warnings (5)
CommandsOnly codeowners can run commands. Post a comment with the command to trigger it.
|
![ask-bonk[bot]](https://avatars.githubusercontent.com/in/2454580?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues need attention before merge.
HIGH — : Step 5 incorrectly frames the WAF custom rule as a way to "restrict access." The linked rule is a skip rule that allows Logpush requests to bypass WAF. Suggested inline.
MEDIUM — : The admonition contains 5 bullet items. The style guide recommends keeping admonitions to ~3 paragraphs or bullet items. Suggested inline.
Overall the troubleshooting section is well-structured and the heading-numbering fix is correct.
| - Setting `host_name` to your R2 endpoint in `inputs.conf`. | ||
| - Setting `sts_private_endpoint_url` to a non-AWS endpoint. | ||
| - Changing the region to `auto` or `us-east-1`. | ||
| - Clearing the private endpoint option. | ||
| ::: | ||
|
|
||
| R2 S3 API compatibility is not the cause. R2 supports the S3 operations that Splunk uses, including `ListObjectsV2`, `GetObject`, and `HeadObject`, and authenticates with Signature Version 4. For details, refer to [R2 S3 API compatibility](/r2/api/s3/api/). | ||
|
|
||
| Use one of the following approaches to send Cloudflare logs to Splunk instead. |
There was a problem hiding this comment.
This admonition exceeds the recommended length. Move the list into regular prose:
| - Setting `host_name` to your R2 endpoint in `inputs.conf`. | |
| - Setting `sts_private_endpoint_url` to a non-AWS endpoint. | |
| - Changing the region to `auto` or `us-east-1`. | |
| - Clearing the private endpoint option. | |
| ::: | |
| R2 S3 API compatibility is not the cause. R2 supports the S3 operations that Splunk uses, including `ListObjectsV2`, `GetObject`, and `HeadObject`, and authenticates with Signature Version 4. For details, refer to [R2 S3 API compatibility](/r2/api/s3/api/). | |
| Use one of the following approaches to send Cloudflare logs to Splunk instead. | |
| :::caution | |
| The following changes do not resolve the error, because the failure happens during account validation. | |
| ::: | |
| The account-level validation blocks every input-level workaround: | |
| - Entering an R2 access key and secret in the account configuration screen. | |
| - Setting `host_name` to your R2 endpoint in `inputs.conf`. | |
| - Setting `sts_private_endpoint_url` to a non-AWS endpoint. | |
| - Changing the region to `auto` or `us-east-1`. | |
| - Clearing the private endpoint option. |
|
|
||
| </Steps> | ||
|
|
||
| #### Use cloud storage as an intermediary |
There was a problem hiding this comment.
The WAF custom rule in the linked section allows Logpush traffic to bypass WAF, so "Restrict access" is misleading.
| #### Use cloud storage as an intermediary | |
| 5. Create a [WAF custom rule](#2-create-waf-custom-rule-for-splunk-hec-endpoint-optional) to allow Logpush requests, or restrict access with an Access service token. |
|
Review complete. I posted two inline suggestions and applied labels Summary of findings:
Other than the inline suggestions, the PR structure is correct: the heading-numbering fix is good, the |
|
Review complete for PR #31274.
What the PR changes: Issues flagged:
Everything else looks good: the |
|
Preview URL: https://f15f7402.preview.developers.cloudflare.com Files with changes (up to 15) |
2 participants
Summary
Adds a troubleshooting subsection to the Splunk Logpush destination page explaining why the Splunk Add-on for AWS cannot read from R2, and documents three supported ways to get Cloudflare logs into Splunk instead.
The add-on validates credentials against AWS STS before saving them, so R2 credentials are always rejected — a recurring support question. The new section covers:
It also fixes a pre-existing heading-numbering bug on the page (the API section jumped from
### 1to### 3).Documentation checklist