All Apps and Add-ons

TA for AWS: Difference between CloudTrail input and SQS-based-S3 input for CloudTrail


Hi community,

I am trying to get my head around the best way to import CloudTrail data from AWS to Splunk.

What I don't understand right now is the difference between these two ways to get CloudTrail data into Splunk when using the Add-On for AWS.

Both inputs use the same mechanism: CloudTrail data is dumped to an S3 bucket, notifications are sent to SNS and forwarded to SQS, Splunk reads from SQS and fetches the data from S3.

Can somebody give me a hint, how these two ways differ and which way would be recommended?


Labels (1)
0 Karma


While I have not found out how the "Cloud Trail input" variant differs from the SQS-based-S3, I tested the SQS-based-S3 variant and it works really well. This variant is also the recommended one as indicated in the Add-On's UI.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>