https://community.splunk.com/t5/Getting-Data-In/How-to-log-Cloudtrail-logs-from-multiple-AWS-accounts/m-p/587325#M103176 <P>Hi Splunkers,</P><P>I have to create an alert when there is a root user login in AWS. For this, I am ingesting cloudtrail logs to distributed splunk env. I want to add organization wide aws accounts to get logs. Adding every single account and creds in Splunk add-on for AWS is difficult. Kindly suggest a way to onboard cloudtrail logs from multiple accounts.</P><P>Thanks</P> Tue, 08 Mar 2022 22:38:23 GMT akasmika 2022-03-08T22:38:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-log-Cloudtrail-logs-from-multiple-AWS-accounts/m-p/587325#M103176 <P>Hi Splunkers,</P><P>I have to create an alert when there is a root user login in AWS. For this, I am ingesting cloudtrail logs to distributed splunk env. I want to add organization wide aws accounts to get logs. Adding every single account and creds in Splunk add-on for AWS is difficult. Kindly suggest a way to onboard cloudtrail logs from multiple accounts.</P><P>Thanks</P> Tue, 08 Mar 2022 22:38:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-log-Cloudtrail-logs-from-multiple-AWS-accounts/m-p/587325#M103176 akasmika 2022-03-08T22:38:23Z