I am trying to query AWS config data in Splunk to identify the names of all S3 buckets in AWS. Is there a way to write a SPL that will list out the S3 bucket names from t
I have attached the raw data to the post. I am trying the following query to identify the ResourceTypes and the count but it is not giving me any results :
index=app_shared source=aws.config | stats count by resourceType | table resourceType
I think we can also narrow down to only - "detail-type": "Config Configuration Item Change"
Please provide sample data to help you with the search query
I have attached the raw data to the post. I am trying the following query to identify the ResourceTypes and the count but it is not giving me any results :
index=app_shared source=aws.config | stats count by resourceType | table resourceType
I think we can also narrow down to only - "detail-type": "Config Configuration Item Change"