A company provisions a log delivery stream inside a VPC and sends VPC flow logs to CloudWatch Logs. They need to forward the flow logs to Splunk in near real time for analysis with minimal operational overhead. Which solution meets this requirement?

The correct solution leverages Kinesis Data Firehose for its direct integration with Splunk and CloudWatch Logs subscription filters for near real-time forwarding. Kinesis Data Firehose is designed for easy data loading into data stores like Splunk with minimal operational overhead, as it handles scaling, buffering, and retries automatically. CloudWatch Logs subscription filters allow you to stream log events to other services as they are ingested, ensuring near real-time delivery. Incorrect options: Using Kinesis Data Streams directly with Splunk requires more configuration and potentially custom connectors, increasing operational overhead compared to Firehose. Implementing an AWS Lambda function to send logs adds unnecessary operational overhead and complexity, as the subscription filter can directly forward to Firehose. This also introduces an additional component that needs to be managed and monitored.