This image shows the process flow that the reference architecture implements.
  1. We define a schedule-based autoscaling policy that contains a cron expression, which triggers a scaling action event in the Events service at periodic intervals.
  2. The event invokes a List Regions & Compartments function, which retrieves the list of regions and compartments that the tenancy is subscribed to, by querying the API.
  3. The function then publishes the data to the Streaming service.
  4. The function also publishes the stream offset and the number of records through the Notifications service.
  5. Next, the function invokes the Fetch Audit Events function.
  6. The function retrieves the audit events from the Audit API.
  7. The function also publishes the stream offset and the number of records through the Notifications service.
  8. Next, the function invokes a Publish to Splunk function.
  9. The function pushes the aggregated audit events to Splunk through an HTTP event collector.