Clean up logs

Author: aurbiztondo-splunk

gdi/get-data-in/connect/aws/aws-logs.rst

@@ -5,40 +5,16 @@ Collect logs from your AWS services
 ****************************************
 
 .. meta::
-  :description: Collect logs from your AWS services in Splunk Observability Cloud.
+  :description: Collect logs from your AWS services in Splunk.
 
-.. caution:: 
-  
-  Splunk Log Observer is no longer available for new users. If you have a Log Observer entitlement, you must transition to Splunk Cloud Platform or Splunk Enterprise. Read more at :ref:`lo-transition`.
-
-  You can also use the Data Manager to send AWS logs to Splunk Platform. Learn how at :new-page:`Onboard AWS in Data Manager <https://docs.splunk.com/Documentation/DM/1.8.2/User/AWSAbout>`.
-
-When setting up an AWS connection, you can choose to import logs from a Cloudwatch log group or an S3 bucket. 
+Log collection is not available in Splunk Observability Cloud. Instead, you can use the Data Manager to send AWS logs to Splunk Platform. Learn how at :new-page:`Onboard AWS in Data Manager <https://docs.splunk.com/Documentation/DM/1.8.2/User/AWSAbout>`. If you have a Log Observer entitlement, you must transition to Splunk Cloud Platform or Splunk Enterprise. Read more at :ref:`lo-transition`.
 
-To set up log collection, follow these steps:
-
-1. Open the link to a :ref:`CloudFormation template <aws-cloudformation>`. 
-2. Adjust the settings. 
-3. Deploy the template to create ``splunk-aws-logs-collector``, an AWS Lambda function used to transform log entries, enrich them with metadata, and send them to Splunk Observability Cloud.
+To query logs, use Log Observer Connect. See more at :ref:`logs-intro-logconnect`.
 
 .. note::
 
   If you experience any issues getting logs from AWS, see :ref:`aws-ts-logs`.
 
-How does log collection work?
-============================================
-
-The Splunk Observability Cloud back end runs a periodic job which goes through CloudWatch log groups and services in your account. This job adds the appropriate subscriptions and notifications to trigger the ``splunk-aws-logs-collector`` function. 
-
-Splunk Observability Cloud adds subscription filters to log groups for the selected services in the integration, or for all of the supported services when none is selected. For instance, if you select ``AWS/Lambda`` in the integration, Splunk Observability Cloud will add subscription filters to ``/aws/lambda/*`` log groups only. Splunk Observability Cloud doesn't capture logs from all CloudWatch log groups.
-
-Managing subscriptions
------------------------------------
-
-Subscriptions are managed every 5 minutes, which is not configurable at the moment. If you decide to turn off the integration or a particular service, the job will attempt to remove those subscriptions.
-  
-If a new log group is created for a service in the integration, Splunk Observability Cloud adds a subscription filter to this newly created log group. Afterwards, whenever new log events are added to the log group, AWS triggers ``splunk-aws-logs-collector`` lambda automatically in near real time. 
-
 Which services can you collect logs from?
 ============================================
 

logs/lo-transition.rst

@@ -9,7 +9,7 @@ Splunk Log Observer transition
   :description: Discover how you can transition from Splunk Log Observer to Splunk Log Observer Connect where you can ingest more logs from a wider variety of data sources, use a more advanced logs pipeline, and expand into security logging by the January 2024 deadline.
 
 
-All Splunk Log Observer customers, who are sending log data to Splunk Observability cloud today,  must transition to using Splunk Cloud Platform or Splunk Enterprise as the central platform for logs by the end of December 2023. Splunk Observability Cloud will continue to support Log Observer functionality and user experience with Splunk Log Observer Connect as a bridge between Splunk Observability Cloud and Splunk Cloud Platform. Transitioning to the Splunk platform, whether it is Splunk Cloud Platform or Splunk Enterprise, as the back-end for log storage does not impact your ability to use Splunk Observability Cloud to correlate logs, metrics, and traces.
+All Splunk Log Observer customers, who are sending log data to Splunk Observability cloud today, must transition to using Splunk Cloud Platform or Splunk Enterprise as the central platform for logs by the end of December 2023. Splunk Observability Cloud will continue to support Log Observer functionality and user experience with Splunk Log Observer Connect as a bridge between Splunk Observability Cloud and Splunk Cloud Platform. Transitioning to the Splunk platform, whether it is Splunk Cloud Platform or Splunk Enterprise, as the back-end for log storage does not impact your ability to use Splunk Observability Cloud to correlate logs, metrics, and traces.
 
 Using the Splunk platform allows you to ingest more logs from a wider variety of data sources, use a more advanced logs pipeline, and use logging for security use cases.