Splunk add-on for AWS - integration with Control Tower - CloudTrail and AWS Config on the same SNS topic

[marcochessa]

Hello All

I wonder if you could share if there is an Splunk decoder for the "Splunk add-on for AWS" that can work well with Control Tower - currently Control Tower sends both CloudTrail and AWS Config to the same SNS Topic in which we've add a SQS queue subscribed to it.

Because the queue now has both CloudTrail and Config,  choosing the "config" decoder generates errors such as the below because most of the messages are CloudTrail.

records = document['configurationItems']
KeyError: 'configurationItems' 

Thank you very much,

Marco