AWS Cloudtrail to Cribl. Cribl to Splunk HEC. AWS Add On Setup.

[xbones84]

So we are in a test environment. We have cloudtrail logs being generated from a Datagen source in Cribl. Those logs are being shipped to a Splunk Index Cluster via HEC (load balanced in Cribl to balance between the members). I have appended the field/value pair of sourceType/aws:cloudtrail and configured the HEC for the cluster inputs.conf to have the sourcetype of aws:cloudtrail. It appears as though my logs are not being indexed into the CIM format. One indicator is I think eventTtype: AwsApiCall should be event_type: AwsApiCall after going through the AWS add on. I have the add-on pushed to the cluster via the manager-apps and it shows up through the peer-apps on the indexers. Is there anything else I need to setup?

[sainag_splunk]

@xbones84 Hi! Since you're using HEC event endpoint.? (/services/collector/event), the sourcetype and metadata are already set when the data reaches Splunk. The AWS Add-on's props.conf configurations don't get applied to HEC event endpoint data because the metadata is predetermined in your JSON payload.

The AWS Add-on assumes data will flow through its inputs where it can apply parsing-time transformations. With HEC event endpoint, you bypass that processing, so you need to handle CIM compliance upstream (in Cribl) or with custom Splunk configurations.