One application of your company was configured to send all application logs to a Kinesis Stream and the logs can exist in the Stream shards for 24 hours. A recent company strategy is to use Splunk Enterprise to search, monitor and analyze application logs and a Splunk server has already been deployed in an EC2 instance. Which approach is the best to load the streaming data in Kinesis Stream to the Splunk instance?

Answer options:

A.Configure the Kinesis Stream to auto deliver the received logs to the Splunk destination for the server to index the logs.
B.Use Amazon Kinesis Data Firehose as a fully managed service to deliver real-time streaming data in Kinesis Stream to the Splunk instance.
C.Use Amazon Kinesis analytics to analyze and transfer real-time streaming data in Kinesis Stream to the destination which is the Splunk instance.
D.Use AWS SDK in an EC2 instance to get the records from Kinesis Stream and forward the records to the Splunk instance.

Correct Answer – B
Amazon Kinesis Data Firehose is a suitable data consumer for the data producer which is the Kinesis Stream in this case. According to
https://docs.aws.amazon.com/firehose/latest/dev/what-is-this-service.html
Kinesis Firehose is used to deliver logs to destinations including Amazon S3, Amazon Redshift, Amazon Elasticsearch Service (Amazon ES), and Splunk.
Option A is incorrect: Because Kinesis Stream cannot automatically deliver logs to Splunk. There is no such feature in Kinesis Stream.
Option B is CORRECT: Streaming data can be delivered to Splunk through Kinesis Firehose as below:
Option C is incorrect: Because Kinesis analytics is mainly used to run continuous analysis. There is no such requirement in this case.
Option D is incorrect: It needs to maintain an EC2 instance for this option. However, Kinesis Firehose is fully managed by AWS and can operate the data in real time. Option B is better from this perspective.