splunk · aurbiztondo-splunk · Aug 9, 2024 · Jun 11, 2024 · Jun 12, 2024 · Jun 12, 2024
@@ -27,7 +27,7 @@ The following table shows the retention time period for each data type in Infras
      - 
        * Standard license edition: 8 days
        * Enterprise license edition: 3 months 
-   * - 1 minute resolution and more (one-minute roll-ups)
+   * - 10 seconds or more
      - 
        * 13 months
 

@@ -7,7 +7,7 @@ Private Connectivity using AWS PrivateLink
 .. meta::
   :description: Connect to AWS using PrivateLink.
 
-You can use Amazon Web Services (AWS) PrivateLink to secure your metric and traces traffic from your AWS environment to your Splunk Observability Cloud environment without exposing it to the Internet. 
+You can use Amazon Web Services (AWS) PrivateLink to secure your metric and traces traffic from your AWS environment to your Splunk Observability Cloud environment without exposing it to the internet. 
 
 AWS PrivateLink connects your Virtual Private Cloud (VPC) to your AWS services, treating them as if they were in your VPC. You can create and use VPC endpoints to securely access AWS services and control the specific API endpoints and sites. To learn more, see the AWS PrivateLink documentation at :new-page:`What is AWS PrivateLink? <https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html>`.
 
@@ -82,12 +82,24 @@ AWS PrivateLink endpoint URLs
     - Coming soon
     - :new-page:`private-stream.au0.signalfx.com <http://private-stream.au0.signalfx.com/>`
 
+  * - eu-central-1
+    - :new-page:`private-ingest.eu1.signalfx.com <http://private-ingest.eu1.signalfx.com/>`
+    - :new-page:`private-api.eu1.signalfx.com <http://private-api.eu1.signalfx.com/>`
+    - Coming soon
+    - :new-page:`private-stream.eu1.signalfx.com <http://private-stream.eu1.signalfx.com/>`
+
   * - eu-west-1
     - :new-page:`private-ingest.eu0.signalfx.com <http://private-ingest.eu0.signalfx.com/>`
     - :new-page:`private-api.eu0.signalfx.com <http://private-api.eu0.signalfx.com/>`
     - Coming soon
     - :new-page:`private-stream.eu0.signalfx.com <http://private-stream.eu0.signalfx.com/>`
 
+  * - eu-west-2
+    - :new-page:`private-ingest.eu2.signalfx.com <http://private-ingest.eu2.signalfx.com/>`
+    - :new-page:`private-api.eu2.signalfx.com <http://private-api.eu2.signalfx.com/>`
+    - Coming soon
+    - :new-page:`private-stream.eu2.signalfx.com <http://private-stream.eu2.signalfx.com/>`
+
   * - us-east-1
     - :new-page:`private-ingest.us0.signalfx.com <http://private-ingest.us0.signalfx.com/>`
     - :new-page:`private-api.us0.signalfx.com <http://private-api.us0.signalfx.com/>`
@@ -128,12 +140,24 @@ AWS PrivateLink service names
     - Coming soon
     - com.amazonaws.vpce.ap-southeast-2.vpce-svc-006a9808c3bf97fc1
 
+  * - eu-central-1
+    - com.amazonaws.vpce.eu-central-1.vpce-svc-0163ebbf011db95fa
+    - com.amazonaws.vpce.eu-central-1.vpce-svc-063722bf4a2e858a3
+    - Coming soon
+    - com.amazonaws.vpce.eu-central-1.vpce-svc-022080c55adaeac78
+
   * - eu-west-1
     - com.amazonaws.vpce.eu-west-1.vpce-svc-01c194b2265ecb86e
     - com.amazonaws.vpce.eu-west-1.vpce-svc-07b08296ff84e17a0
     - Coming soon
     - com.amazonaws.vpce.eu-west-1.vpce-svc-0d036df6dbc6ddadb
 
+  * - eu-west-2
+    - com.amazonaws.vpce.eu-west-2.vpce-svc-0f7427a7b9ef925b0
+    - com.amazonaws.vpce.eu-west-2.vpce-svc-0719f35de75c08514
+    - Coming soon
+    - com.amazonaws.vpce.eu-west-2.vpce-svc-0bc5b13127f2916ce
+
   * - us-east-1
     - com.amazonaws.vpce.us-east-1.vpce-svc-0336437d577075951
     - com.amazonaws.vpce.us-east-1.vpce-svc-089b68950f5be1c22
@@ -212,7 +236,7 @@ To create a VPC endpoint, follow these steps:
 
 5. Select the VPC in which you want to create the endpoint. 
 
-6. Choose the subnet or subnets within the VPC where the endpoint will reside. Make sure to select the subnets from the appropriate availability zones.
+6. Select the subnet or subnets within the VPC where the endpoint will reside. Make sure to select the subnets from the appropriate availability zones.
 
 7. Set the IP address type to ``IPv4``.
 
@@ -226,21 +250,21 @@ To create a VPC endpoint, follow these steps:
 
 9. Review the configuration details and select :guilabel:`Create Endpoint`.
 
-10. Before proceeding to :ref:`aws-privatelink-step4`, confirm with Splunk Customer Support that you created the endpoint, that the service name has been verified, and that Support has enabled the endpoint urls.
+10. Before proceeding to :ref:`aws-privatelink-step4`, confirm with Splunk Customer Support that you created the endpoint, that the service name has been verified, and that Support has activated the endpoint urls.
 
 .. _aws-privatelink-step4:
 
-Step 4: Modify the endpoint to enable a Private DNS Name
+Step 4: Modify the endpoint to activate a Private DNS Name
 ----------------------------------------------------------------
 
-To modify the endpoint to enable a Private DNS Name, follow these steps:
+To modify the endpoint to activate a Private DNS Name, follow these steps:
 
 #. Log in to the AWS Management Console.
 #. Navigate to the :guilabel:`Amazon VPC service` in the region where you have created the VPC endpoint.
 #. On the left navigation pane, select :guilabel:`Endpoints`.
 #. Select the VPC endpoint you want to modify.
 #. Select :guilabel:`Actions`, and then :guilabel:`Modify Endpoint`.
-#. Enable the private DNS names under the :guilabel:`Modify private DNS name` settings.
+#. Turn on the private DNS names under the :guilabel:`Modify private DNS name` settings.
 #. After the process is completed, select :guilabel:`Save Changes`.
 
 You can now start using the AWS PrivateLink URL mentioned in the :ref:`AWS PrivateLink endpoint URLs table <aws-privatelink-endpoint-urls>`.

@@ -154,27 +154,42 @@ Available regions or realms
 
 Splunk Observability Cloud is available in the following global regions. Each Cloud provider region is mapped to a Splunk Observability Cloud realm, which determines access URLs and endpoints.
 
+Realm to region equivalence
+----------------------------------------------------------
+
+The following table shows which cloud regions correspond to each realm in Splunk Observability Cloud.
+
 .. list-table::
    :header-rows: 1
-   :widths: 25 25 25 25
    :width: 100%
 
-   * - 
-     - :strong:`AWS regions`
-     - :strong:`Google Cloud regions`
-     - :strong:`Splunk Observability Cloud realm`
-   * - Splunk Observability Cloud
+   * - :strong:`Splunk Observability Cloud Realm`
+     - :strong:`AWS Region`
+     - :strong:`GCP Region`
+   * - us0
+     - AWS US East Virginia (us-east-1)
      - 
-        * US: Oregon (us-west-2), Virginia (us-east-1)
-        * Europe: Dublin (eu-west-1)
-        * Asia Pacific: Sydney (ap-southeast-2), Tokyo (ap-northeast-1)
+   * - us1
+     - AWS US West Oregon (us-west-2)
      - 
-       * US: Oregon (us-west-1)
+   * - us2
+     - 
+     - GCP US Oregon (us-west-1)
+   * - eu0
+     - AWS EU Dublin (eu-west-1)
+     -
+   * - eu1
+     - AWS EU Frankfurt (eu-central-1)
+     -
+   * - eu2
+     - AWS EU London (eu-west-2)
+     -
+   * - au0
+     - AWS AP Sydney (ap-southeast-2)
+     - 
+   * - jp0
+     - AWS AP Tokyo (ap-northeast-1)
      - 
-        * us0, us1, us2
-        * eu0
-        * au0, jp0
-
 
 
 Available components per region or realm
@@ -194,90 +209,60 @@ The following components are available for each global region. Each Cloud provid
    * - Application Performance Monitoring (APM)
      - 
         * US: Oregon (us-west-2), Virginia (us-east-1)
-        * Europe: Dublin (eu-west-1)
+        * Europe: Dublin (eu-west-1), Frankfurt (eu-central-1), London (eu-west-2)
         * Asia Pacific: Sydney (ap-southeast-2), Tokyo (ap-northeast-1)
      - 
        * US: Oregon (us-west-1)
      - 
        * us0, us1, us2
-       * eu0
+       * eu0, eu1, eu2
        * au0, jp0
    * - Infrastructure Monitoring (IM)
      - 
        * US: Oregon (us-west-2), Virginia (us-east-1)
-       * Europe: Dublin (eu-west-1)
+       * Europe: Dublin (eu-west-1), Frankfurt (eu-central-1), London (eu-west-2)
        * Asia Pacific: Sydney (ap-southeast-2), Tokyo (ap-northeast-1)
      - 
        * US: Oregon (us-west-1)
      - 
        * us0, us1, us2
-       * eu0
+       * eu0, eu1, eu2
        * au0, jp0
    * - Log Observer Connect
      - 
        * US: Oregon (us-west-2), Virginia (us-east-1)
-       * Europe: Dublin (eu-west-1)
+       * Europe: Dublin (eu-west-1), Frankfurt (eu-central-1), London (eu-west-2)
        * Asia Pacific: Sydney (ap-southeast-2), Tokyo (ap-northeast-1)
      - 
        * US: Oregon (us-west-1)
      - 
        * us0, us1, us2
-       * eu0
+       * eu0, eu1, eu2
        * au0, jp0
    * - Real User Monitoring (RUM)
      - 
        * US: Oregon (us-west-2), Virginia (us-east-1)
-       * Europe: Dublin (eu-west-1)
+       * Europe: Dublin (eu-west-1), Frankfurt (eu-central-1), London (eu-west-2)
        * Asia Pacific: Sydney (ap-southeast-2)
      - 
        * US: Oregon (us-west-1)
      -
        * us0, us1, us2
-       * eu0
+       * eu0, eu1, eu2
        * au0
    * - Synthetic Monitoring
      - 
        * US: Oregon (us-west-2), Virginia (us-east-1)
-       * Europe: Dublin (eu-west-1)
+       * Europe: Dublin (eu-west-1), Frankfurt (eu-central-1), London (eu-west-2)
        * Asia Pacific: Sydney (ap-southeast-2), Tokyo (ap-northeast-1)
      - 
        * US: Oregon (us-west-1)
      -
        * us0, us1, us2
-       * eu0
+       * eu0, eu1, eu2
        * au0, jp0
 
 
-Realm to region equivalence
-----------------------------------------------------------
-
-The following table shows which cloud regions correspond to each realm in Splunk Observability Cloud.
-
-.. list-table::
-   :header-rows: 1
-   :width: 100%
-
-   * - :strong:`Splunk Observability Cloud Realm`
-     - :strong:`AWS Region`
-     - :strong:`GCP Region`
-   * - us0
-     - AWS US East Virginia (us-east-1)
-     - 
-   * - us1
-     - AWS US West Oregon (us-west-2)
-     - 
-   * - us2
-     - 
-     - GCP US Oregon (us-west-1)
-   * - eu0
-     - AWS EU Dublin (eu-west-1)
-     -
-   * - au0
-     - AWS AP Sydney (ap-southeast-2)
-     - 
-   * - jp0
-     - AWS AP Tokyo (ap-northeast-1)
-     - 
 
 For additional information, see:
 

@@ -94,11 +94,11 @@ The following table shows how long data is retained at different resolutions.
 
    *  -  1 second
       -  8 days
-      -  ~3 months (96 days)
+      -  3 months (96 days)
 
-   *  -  10 seconds, 1 minute, 5 minutes, 1 hour
-      -  ~13 months (416 days)
-      -  ~13 months (416 days)
+   *  -  10 seconds or more
+      -  13 months (416 days)
+      -  13 months (416 days)
 
 For more information on rollups in general, and how they apply to charts and detectors, see :ref:`rollups`.
 

@@ -37,10 +37,12 @@ Ensure the following configuration in your Splunk Enterprise instance:
   - us1: ``44.230.152.35``, ``44.231.27.66``, ``44.225.234.52``, ``44.230.82.104``
   - us2: ``35.247.113.38/32``, ``35.247.32.72/32``, ``35.247.86.219/32``
   - eu0: ``108.128.26.145``, ``34.250.243.212``, ``54.171.237.247``
+  - eu1: ``3.73.240.7``, ``18.196.129.64``, ``3.126.181.171``
+  - eu2: ``13.41.86.83``, ``52.56.124.93``, ``35.177.204.133``
   - jp0: ``35.78.47.79``, ``35.77.252.198``, ``35.75.200.181``
   - au0: ``13.54.193.47``, ``13.55.9.109``, ``54.153.190.59``
 
-* Expose port ``8089`` to all the IPs of the realms you're using. Log Observer Connect needs to be able to access the search head on port ``8089``. It doesn't need to directly access the deployer or indexers. For example, if you have a search head cluster with load balancer in front of the members of the search head cluster, you would allow the incoming traffic to the load balancer.
+* Expose port ``8089`` to all the IPs of the realms you're using. Log Observer Connect needs to be able to access the search head on port ``8089``. It doesn't need to directly access the deployer or indexers. For example, if you have a search head cluster with load balancer in front of the members of the search head cluster, you allow the incoming traffic to the load balancer.
 
 .. caution:: Check with your security team before you add these IPs to the allow list of your firewall rules or to your security groups in AWS.
 
@@ -86,7 +88,7 @@ In your Splunk Enterprise search head, follow the instructions in the guided set
          :width: 100%
          :alt: This screenshot shows recommended configuration for role search job limit and user search job limit.
 
-6. Now, in the :guilabel:`Role search time window limit` section of the :guilabel:`Resources` tab, select :guilabel:`Custom time` and enter 2592000 seconds (30 days) for the maximum time window for searches for this role. For the earliest searchable event time for this role,  select :guilabel:`Custom time` and enter 7776000 seconds (90 days). In the :guilabel:`Disk space limit` section enter a :guilabel:`Standard search limit` of 1000 MB.
+6. Now, in the :guilabel:`Role search time window limit` section of the :guilabel:`Resources` tab, select :guilabel:`Custom time` and enter 2592000 seconds (30 days) for the maximum time window for searches for this role. For the earliest searchable event time for this role, select :guilabel:`Custom time` and enter 7776000 seconds (90 days). In the :guilabel:`Disk space limit` section enter a :guilabel:`Standard search limit` of 1000 MB.
 
       .. image:: /_images/logs/ResourcesTab2.png
          :width: 100%
@@ -106,4 +108,4 @@ In your Splunk Enterprise search head, follow the instructions in the guided set
 
 Troubleshooting
 ==============================================================
-See :ref:`logs-LOconnect-troubleshoot` to learn how to solve common  issues with Log Observer Connect.
+See :ref:`logs-LOconnect-troubleshoot` to learn how to solve common issues with Log Observer Connect.
@@ -0,0 +1,59 @@
+Location ID,Display Name,World Region,IP Addresses,Provider
+aws-af-south-1, AWS - Cape Town, Africa, "13.246.211.10, 13.246.73.235, 13.247.44.157", Amazon
+aws-af-south-1-los-1, AWS LZ - Lagos, Africa, "96.0.45.11", Amazon (Local Zone)
+aws-ap-east-1, AWS - Hong Kong, Asia Pacific, "16.163.8.89, 18.166.218.90, 43.198.43.10", Amazon
+aws-ap-northeast-1, AWS - Tokyo, Asia Pacific, "13.115.193.210, 54.150.194.88, 54.250.155.160", Amazon
+aws-ap-northeast-1-tpe-1, AWS LZ - Taipei, Asia Pacific, "15.220.84.250", Amazon (Local Zone)
+aws-ap-northeast-2, AWS - Seoul, Asia Pacific, "13.125.115.194, 13.209.233.45, 3.34.229.210", Amazon
+aws-ap-northeast-3, AWS - Osaka, Asia Pacific, "13.208.142.78, 15.168.113.82, 15.168.183.161", Amazon
+aws-ap-south-1, AWS - Mumbai, Asia Pacific, "13.235.117.154, 3.110.241.254, 52.66.153.208", Amazon
+aws-ap-south-1-ccu-1, AWS LZ - Kolkata, Asia Pacific, "96.0.64.148", Amazon (Local Zone)
+aws-ap-south-1-del-1, AWS LZ - Delhi, Asia Pacific, "15.220.136.125", Amazon (Local Zone)
+aws-ap-south-2, AWS - Hyderabad, Asia Pacific, "18.60.230.234, 18.61.136.57, 98.130.3.205", Amazon
+aws-ap-southeast-1, AWS - Singapore, Asia Pacific, "18.139.80.255, 52.77.120.222, 54.251.195.162", Amazon
+aws-ap-southeast-1-bkk-1, AWS LZ - Bangkok, Asia Pacific, "15.220.243.36", Amazon (Local Zone)
+aws-ap-southeast-2, AWS - Sydney, Asia Pacific, "3.105.125.176, 54.253.44.253, 54.66.202.232", Amazon
+aws-ap-southeast-2-per-1, AWS LZ - Perth, Asia Pacific, "96.0.4.180", Amazon (Local Zone)
+aws-ap-southeast-3, AWS - Jakarta, Asia Pacific, "108.136.136.86, 108.136.74.173, 108.137.59.183", Amazon
+aws-ap-southeast-4, AWS - Melbourne, Asia Pacific, "16.51.107.115, 16.51.192.145, 16.51.36.10", Amazon
+aws-ca-central-1, AWS - Montreal, North America, "15.156.146.200, 3.98.27.17, 3.99.75.150", Amazon
+aws-eu-central-1, AWS - Frankfurt, Europe, "18.192.166.200, 18.199.217.157, 52.58.2.35", Amazon
+aws-eu-central-1-ham-1, AWS LZ - Hamburg, Europe, "15.220.153.29", Amazon (Local Zone)
+aws-eu-central-1-waw-1, AWS LZ - Warsaw, Europe, "15.220.64.114", Amazon (Local Zone)
+aws-eu-central-2, AWS - Zurich, Europe, "16.63.217.197, 16.63.247.67, 51.96.34.249", Amazon
+aws-eu-north-1, AWS - Stockholm, Europe, "13.50.144.220, 16.170.154.146, 16.170.83.63", Amazon
+aws-eu-north-1-cph-1, AWS LZ - Copenhagen, Europe, "96.0.25.92", Amazon (Local Zone)
+aws-eu-north-1-hel-1, AWS LZ - Helsinki, Europe, "15.220.168.29", Amazon (Local Zone)
+aws-eu-south-1, AWS - Milan, Europe, "15.161.29.228, 18.102.235.209, 35.152.34.183", Amazon
+aws-eu-south-2, AWS - Spain, Europe, "18.100.189.242, 18.101.78.20, 51.92.3.73", Amazon
+aws-eu-west-1, AWS - Dublin, Europe, "3.248.102.231, 34.253.39.101, 52.48.207.91", Amazon
+aws-eu-west-2, AWS - London, Europe, "13.42.239.221, 18.171.81.91, 3.11.248.24", Amazon
+aws-eu-west-3, AWS - Paris, Europe, "13.36.205.53, 13.37.135.142, 15.236.32.122", Amazon
+aws-me-central-1, AWS - UAE, Middle East, "3.28.115.204, 3.29.145.14, 3.29.212.108", Amazon
+aws-me-south-1, AWS - Bahrain, Middle East, "15.184.12.28, 15.184.15.204, 157.175.137.169", Amazon
+aws-me-south-1-mct-1, AWS LZ - Muscat, Middle East, "15.220.161.141", Amazon (Local Zone)
+aws-sa-east-1, AWS - São Paulo, South America, "18.230.80.81, 52.67.142.96, 54.233.162.39", Amazon
+aws-us-east-1, AWS - N. Virginia, North America, "100.26.95.140, 18.204.61.24, 54.225.210.39", Amazon
+aws-us-east-1-atl-1, AWS LZ - Atlanta, North America, "15.181.88.209", Amazon (Local Zone)
+aws-us-east-1-bos-1, AWS LZ - Boston, North America, "68.66.115.207", Amazon (Local Zone)
+aws-us-east-1-bue-1, AWS LZ - Buenos Aires, South America, "15.220.123.89", Amazon (Local Zone)
+aws-us-east-1-chi-1, AWS LZ - Chicago, North America, "15.181.178.199", Amazon (Local Zone)
+aws-us-east-1-dfw-1, AWS LZ - Dallas, North America, "15.181.197.10", Amazon (Local Zone)
+aws-us-east-1-iah-1, AWS LZ - Houston, North America, "72.41.5.56", Amazon (Local Zone)
+aws-us-east-1-lim-1, AWS LZ - Lima, South America, "96.0.21.215", Amazon (Local Zone)
+aws-us-east-1-mci-1, AWS LZ - Kansas City, North America, "15.181.98.56", Amazon (Local Zone)
+aws-us-east-1-mia-1, AWS LZ - Miami, North America, "64.187.136.245", Amazon (Local Zone)
+aws-us-east-1-msp-1, AWS LZ - Minneapolis, North America, "15.181.48.236", Amazon (Local Zone)
+aws-us-east-1-nyc-1, AWS LZ - New York City, North America, "15.181.161.95", Amazon (Local Zone)
+aws-us-east-1-phl-1, AWS LZ - Philadelphia, North America, "15.181.144.76", Amazon (Local Zone)
+aws-us-east-1-qro-1, AWS LZ - Querétaro, North America, "15.220.184.8", Amazon (Local Zone)
+aws-us-east-1-scl-1, AWS LZ - Santiago, South America, "96.0.50.48", Amazon (Local Zone)
+aws-us-east-2, AWS - Ohio, North America, "3.129.240.187, 3.132.190.123, 3.141.128.182", Amazon
+aws-us-west-1, AWS - N. California, North America, "52.9.132.35, 52.9.47.179", Amazon
+aws-us-west-2, AWS - Oregon, North America, "44.226.175.92, 52.11.116.104, 52.89.114.115", Amazon
+aws-us-west-2-den-1, AWS LZ - Denver, North America, "15.181.19.117", Amazon (Local Zone)
+aws-us-west-2-las-1, AWS LZ - Las Vegas, North America, "15.220.16.56", Amazon (Local Zone)
+aws-us-west-2-lax-1, AWS LZ - Los Angeles, North America, "15.254.22.248, 70.224.229.90", Amazon (Local Zone)
+aws-us-west-2-pdx-1, AWS LZ - Portland, North America, "15.220.6.147", Amazon (Local Zone)
+aws-us-west-2-phx-1, AWS LZ - Phoenix, North America, "15.181.128.95", Amazon (Local Zone)
+aws-us-west-2-sea-1, AWS LZ - Seattle, North America, "15.181.4.125", Amazon (Local Zone)