Adding Historical Cloudtrail Logs

philip_watts · ‎09-02-2014

I recently installed the Splunk App for AWS and followed the SNS and SQS setup instructions for getting cloud trail logs into Splunk. This configuration is working, however it is only working for new cloud trail logs. I'd like to be able to ingest past logs, but haven't found a way as of yet.

Any tips?

_d_ · ‎11-16-2014

You can install the Splunk Add-on for Amazon Web Services (https://apps.splunk.com/app/1876/) and configure/point its S3 input to your CloudTrail bucket.

Adding Historical Cloudtrail Logs

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Guided Onboarding with Auto-schema Is Now Generally Available

ATTENTION: We’re Moving! (AGAIN!)

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

Join the Conversation

Adding Historical Cloudtrail Logs

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Guided Onboarding with Auto-schema Is Now Generally Available

ATTENTION: We’re Moving! (AGAIN!)

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud