Adding Historical Cloudtrail Logs

philip_watts · ‎09-02-2014

I recently installed the Splunk App for AWS and followed the SNS and SQS setup instructions for getting cloud trail logs into Splunk. This configuration is working, however it is only working for new cloud trail logs. I'd like to be able to ingest past logs, but haven't found a way as of yet.

Any tips?

_d_ · ‎11-16-2014

You can install the Splunk Add-on for Amazon Web Services (https://apps.splunk.com/app/1876/) and configure/point its S3 input to your CloudTrail bucket.

Adding Historical Cloudtrail Logs

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Auto Ingestion Parallel Pipeline Scaling

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation

Adding Historical Cloudtrail Logs

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Auto Ingestion Parallel Pipeline Scaling

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience