Hi All,
I am exporing splunk these days. I have installed splunk enterprize on my linux machine. I want to monitor my AWS account logs on splunk. For this I have want to install Splunk app for AWS.
Here are my queries :
The documentation with the app is pretty straightforward. To summarize them, you need Splunk, and yes, you need to configure CloudTrail in AWS. You don't need to edit config files (though you can if you want and are familiar with it) but you can just configure a new CloudTrail input. Most people will need only one, but if you're logging different regions to different places, or have multiple accounts, you can configure multiple CloudTrail inputs.
I have configured the cloud trail but getting error : std::bad_alloc
I have configured cloud trail on my AWS account but I cant see any data in my Splunk App for AWS. DO I need to update my aws keys in any of the file in splunk app ???Please help