Splunk Enterprise Security

Splunk App and Add-on for Amazon Web Services: Log search Cloudfront .gz log from S3 files

mounavignesh
New Member

I'm not able to search cloud-front logs from S3. There is no results. But I'm able to search ELB logs and Cloud-trail logs from S3. 

Below are my input.conf 

[splunk_ta_aws_logs://Cloudfront_logs]
aws_account = splunk_DEV
bucket_name = Mybucketname
bucket_region = us-east-1
host_name = s3.amazonaws.com
interval = 1800
log_file_prefix = cdn_logs
log_name_format = ABCDEFGH.%Y-%m-%d-
log_start_date = 2020-01-01
log_type = cloudfront:accesslogs
max_fails = 10000
max_retries = -1
sourcetype = aws:cloudfront:accesslogs

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...