CloudTrail Setup

[rmadabhushanam]

Hello,

I've been trying to configure Cloud Trail using SplunkforAWS App. Even after completing all steps listed in the USAGE guide, data is not getting populated. Also I do not see any errors anywhere? How should I troubleshoot this? Any guidence for troubleshooting like log file locations or specific configurations would be highly appreciated.

Thanks a lot for your help..

Regards,
Ravi.M

[nkhetia · Accepted solution]

This has been resolved. what we did is to re-subscribe the SQS queue to SNS topic from SQS screen. Also while configuring CloudTrail inputs :

Select More Settings checkbox.

Set Source type as Manual and specify aws-cloudtrail as Source type.

Under index, select destination index as aws-cloudtrail.

Ravi - Could you accept this and resolve this question ?

thanks
Nilesh