topic AWS Config data in Splunk in Splunk Search

AWS Config data in Splunk

amitshrigoel — Thu, 09 Jan 2025 18:55:48 GMT

I am trying to query AWS config data in Splunk to identify the names of all S3 buckets in AWS. Is there a way to write a SPL that will list out the S3 bucket names from t

Re: AWS Config data in Splunk

PaulPanther — Fri, 10 Jan 2025 08:27:49 GMT

Please provide sample data to help you with the search query

Re: AWS Config data in Splunk

ezamit — Mon, 13 Jan 2025 16:09:41 GMT

I have attached the raw data to the post. I am trying the following query to identify the ResourceTypes and the count but it is not giving me any results :

index=app_shared source=aws.config | stats count by resourceType | table resourceType

I think we can also narrow down to only - "detail-type": "Config Configuration Item Change"

Re: AWS Config data in Splunk

ezamit — Mon, 13 Jan 2025 21:54:38 GMT

I have attached the raw data to the post. I am trying the following query to identify the ResourceTypes and the count but it is not giving me any results :

index=app_shared source=aws.config | stats count by resourceType | table resourceType

I think we can also narrow down to only - "detail-type": "Config Configuration Item Change"