topic CloudTrail Setup in Splunk Enterprise

CloudTrail Setup

rmadabhushanam — Tue, 03 Dec 2013 12:23:08 GMT

Hello,

I've been trying to configure Cloud Trail using SplunkforAWS App. Even after completing all steps listed in the USAGE guide, data is not getting populated. Also I do not see any errors anywhere? How should I troubleshoot this? Any guidence for troubleshooting like log file locations or specific configurations would be highly appreciated.

Thanks a lot for your help..

Regards,
Ravi.M

Re: CloudTrail Setup

nkhetia — Tue, 03 Dec 2013 21:49:38 GMT

This has been resolved. what we did is to re-subscribe the SQS queue to SNS topic from SQS screen. Also while configuring CloudTrail inputs :

Select More Settings checkbox.

Set Source type as Manual and specify aws-cloudtrail as Source type.

Under index, select destination index as aws-cloudtrail.

Ravi - Could you accept this and resolve this question ?

thanks
Nilesh