All Apps and Add-ons

Adding Historical Cloudtrail Logs

New Member

I recently installed the Splunk App for AWS and followed the SNS and SQS setup instructions for getting cloud trail logs into Splunk. This configuration is working, however it is only working for new cloud trail logs. I'd like to be able to ingest past logs, but haven't found a way as of yet.

Any tips?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

You can install the Splunk Add-on for Amazon Web Services (https://apps.splunk.com/app/1876/) and configure/point its S3 input to your CloudTrail bucket.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!