I am trying to get my head around the best way to import CloudTrail data from AWS to Splunk.
What I don't understand right now is the difference between these two ways to get CloudTrail data into Splunk when using the Add-On for AWS.
Both inputs use the same mechanism: CloudTrail data is dumped to an S3 bucket, notifications are sent to SNS and forwarded to SQS, Splunk reads from SQS and fetches the data from S3.
Can somebody give me a hint, how these two ways differ and which way would be recommended?
While I have not found out how the "Cloud Trail input" variant differs from the SQS-based-S3, I tested the SQS-based-S3 variant and it works really well. This variant is also the recommended one as indicated in the Add-On's UI.