TA for AWS: Difference between CloudTrail input and SQS-based-S3 input for CloudTrail

[benjaminruland]

Hi community,

I am trying to get my head around the best way to import CloudTrail data from AWS to Splunk.

What I don't understand right now is the difference between these two ways to get CloudTrail data into Splunk when using the Add-On for AWS.

• First way: Cloud Trail Input
• Second way: SQS-based-S3 input with type CloudTrail

Both inputs use the same mechanism: CloudTrail data is dumped to an S3 bucket, notifications are sent to SNS and forwarded to SQS, Splunk reads from SQS and fetches the data from S3.

Can somebody give me a hint, how these two ways differ and which way would be recommended?

Thanks!

[sonalipatil]

Hello, 

We are also trying to find out the same. Were you able to figure out the difference or get any response from Splunk.

[benjaminruland]

While I have not found out how the "Cloud Trail input" variant differs from the SQS-based-S3, I tested the SQS-based-S3 variant and it works really well. This variant is also the recommended one as indicated in the Add-On's UI.