Adding Historical Cloudtrail Logs

[philip_watts]

I recently installed the Splunk App for AWS and followed the SNS and SQS setup instructions for getting cloud trail logs into Splunk. This configuration is working, however it is only working for new cloud trail logs. I'd like to be able to ingest past logs, but haven't found a way as of yet.

Any tips?

[_d_]

You can install the Splunk Add-on for Amazon Web Services (https://apps.splunk.com/app/1876/) and configure/point its S3 input to your CloudTrail bucket.