How to change Host for AWS cloudtrail input to be ...

Splunk Enterprise

Hello

I would like AWS cloudtrail logs "Host" field to be the Account ID per each log (we have multiple AWS accounts). The current value is "$decideOnStartup".

We are using SQS-based S3 to read a bucket containing CloudTrail from several accounts.

Is there any way to do it?

Thank you

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members! The ...