Splunk Enterprise

How to change Host for AWS cloudtrail input to be Account ID?

avivfri
Explorer

Hello

I would like AWS cloudtrail logs "Host" field to be the Account ID per each log (we have multiple AWS accounts). The current value is "$decideOnStartup".

We are using SQS-based S3 to read a bucket containing CloudTrail from several accounts.

Is there any way to do it?

Thank you

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...