How to set up AWS Cloud Trail in the Splunk App for AWS?

[Rocky31]

Where do I need to install the app (indexer or search head)?

What is the procedure for that?

[jkat54 · Accepted solution]

Start here, with the documentation on AWS add-on:

https://splunkbase.splunk.com/app/1876/#/documentation
http://docs.splunk.com/Documentation/AddOns/latest/AWS/Description

Then once you have the AWS add-on setup you can install the splunk app for AWS, and/or configure cloudtrail:
http://docs.splunk.com/Documentation/AddOns/latest/AWS/CloudTrail

Where to install is covered in the documentation.