topic [AWS Trumpet] Only partial CloudTrail logs compared to the AWS Add-on? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/AWS-Trumpet-Only-partial-CloudTrail-logs-compared-to-the-AWS-Add/m-p/518519#M87664 <P>I am using the&nbsp;<A href="https://github.com/splunk/splunk-aws-project-trumpet" target="_blank" rel="noopener">https://github.com/splunk/splunk-aws-project-trumpet</A>&nbsp;to get AWS logs in, I am facing an issue though with only partial CloudTrail logs compared to the AWS TA. Any suggestions?&nbsp;</P> <P>On the CloudFormation template does this effectively only collect this event pattern?</P> <LI-CODE lang="markup">EventPattern":{ "detail-type":[ "AWS API Call via CloudTrail", "AWS Console Sign In via CloudTrail"</LI-CODE> <P>&nbsp;</P> Tue, 08 Sep 2020 19:29:04 GMT wendelclark 2020-09-08T19:29:04Z [AWS Trumpet] Only partial CloudTrail logs compared to the AWS Add-on? https://community.splunk.com/t5/Getting-Data-In/AWS-Trumpet-Only-partial-CloudTrail-logs-compared-to-the-AWS-Add/m-p/518519#M87664 <P>I am using the&nbsp;<A href="https://github.com/splunk/splunk-aws-project-trumpet" target="_blank" rel="noopener">https://github.com/splunk/splunk-aws-project-trumpet</A>&nbsp;to get AWS logs in, I am facing an issue though with only partial CloudTrail logs compared to the AWS TA. Any suggestions?&nbsp;</P> <P>On the CloudFormation template does this effectively only collect this event pattern?</P> <LI-CODE lang="markup">EventPattern":{ "detail-type":[ "AWS API Call via CloudTrail", "AWS Console Sign In via CloudTrail"</LI-CODE> <P>&nbsp;</P> Tue, 08 Sep 2020 19:29:04 GMT https://community.splunk.com/t5/Getting-Data-In/AWS-Trumpet-Only-partial-CloudTrail-logs-compared-to-the-AWS-Add/m-p/518519#M87664 wendelclark 2020-09-08T19:29:04Z