Splunk to Amazon CloudWatch Migrations

Amazon CloudWatch is AWS’s native monitoring and observability service. It collects and tracks metrics, logs, and events from AWS services, custom applications, and on-premises resources — providing a unified operational view of your AWS environment.

CloudWatch includes dashboards for visualizing resource health, alarms for automated notifications and operational responses, Logs Insights for log querying and analysis, and Container Insights for Kubernetes and ECS workloads. For organizations running workloads primarily on AWS, CloudWatch provides deep native integration with the services they already use. Crest Data’s migration service handles the full transition from Splunk to CloudWatch — converting dashboards, alerts, and log queries while preserving your existing monitoring workflows.

Amazon CloudWatch serves several core observability functions:

• Metrics collection — automatically collects performance metrics from all AWS services (EC2, Lambda, RDS, EKS, and more) as well as custom application metrics.
• Log management — ingests, stores, and enables querying of log data via CloudWatch Logs and Logs Insights.
• Alarms and notifications — triggers alerts based on metric thresholds and sends notifications through SNS, email, or third-party integrations.
• Dashboards — provides customizable operational dashboards for monitoring AWS resource health and application performance.
• Container monitoring — offers Container Insights for detailed monitoring of EKS and ECS environments.

During a Splunk to CloudWatch migration, Crest Data maps each of your existing Splunk monitoring capabilities to the corresponding CloudWatch feature, ensuring nothing is lost in the transition.

Amazon CloudWatch includes a free tier that covers basic monitoring for AWS services, including standard metrics at 5-minute intervals, 10 alarm metrics, 3 dashboards with up to 50 metrics each, and 5GB of log data ingestion and storage per month. Detailed monitoring, custom metrics, additional dashboards, and Logs Insights queries are available on a pay-as-you-go basis beyond the free tier.

CloudWatch’s pricing is usage-based and scales with your AWS footprint, which means costs are closely tied to your actual monitoring activity. As part of every Splunk to CloudWatch migration, Crest Data provides a cost modelling exercise to help you estimate your expected CloudWatch spend based on your current Splunk data volumes and monitoring scope.

Amazon CloudWatch Logs is the log management component of CloudWatch. It ingests, stores, and enables real-time monitoring and analysis of log data from AWS services, EC2 instances, Lambda functions, containerized applications, and custom sources via the CloudWatch Agent or API.

CloudWatch Logs includes Logs Insights, a purpose-built query interface for interactive log analysis, and supports metric filters that can convert log patterns into CloudWatch metrics for alarming and dashboarding. Log retention is fully configurable, from 1 day to 10 years. During a Splunk to CloudWatch migration, Crest Data converts your Splunk saved searches and dashboards into Logs Insights queries and CloudWatch Dashboard widgets, maintaining full equivalence with your existing log monitoring setup.

Amazon CloudWatch retains metric data at different resolutions and durations:

• High-resolution metrics (1-second) — retained for 3 hours
• Detailed metrics (1-minute) — retained for 15 days
• Standard metrics (5-minute) — retained for 63 days
• Low-resolution metrics (1-hour) — retained for 15 months

CloudWatch Logs retention is fully configurable per log group — from 1 day to 10 years, or set to never expire. For long-term log archival beyond standard retention windows, logs can be exported to Amazon S3 at low storage cost.

Data retention requirements are an important part of any Splunk to CloudWatch migration planning. Crest Data’s migration assessment includes a review of your current Splunk retention policies and maps them to the appropriate CloudWatch configuration.