[AWS Trumpet] Only partial CloudTrail logs compare...

Getting Data In

I am using the https://github.com/splunk/splunk-aws-project-trumpet to get AWS logs in, I am facing an issue though with only partial CloudTrail logs compared to the AWS TA. Any suggestions?

On the CloudFormation template does this effectively only collect this event pattern?

EventPattern":{
"detail-type":[
"AWS API Call via CloudTrail",
"AWS Console Sign In via CloudTrail"

Get Updates on the Splunk Community!

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Are you a member of the Splunk Community?