Filter AWS Cloudtrail AwsApiCall events?

martaBenedetti — Thu, 13 Oct 2022 14:53:13 GMT

Does anybody know a good way to filter out AWS Cloudtrail events? I'd like to send to null queue events that contains eventType=AwsApiCall.

This is what I have on my HF where the Splunk_TA_AWS is installed and configured:

transforms.conf

[eliminate-AwsApiCall] REGEX = \"eventType\":\s+\"AwsApiCall\" DEST_KEY = queue FORMAT = nullQueue

props.conf:

[aws:cloudtrail] TRANSFORMS-eliminate-AwsApiCall = eliminate-AwsApiCall

Doesn't seem to be filtering ... any thoughts?

Thanks

Marta

topic Filter AWS Cloudtrail AwsApiCall events? in Getting Data In