dwhitehead

Topics I've Started

I tried the same thing and found the same issue. I think the blacklist config is only compatible with the cloudtrail input NOT the sqs_based_s3 input. Really unfortunate as I wanted to switch to role based cloudtrail logging rather than aws account. Please put this on your bug litst Splunk.

Posts	1
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎04-17-2024

Online Status	Offline
Date Last Visited	‎04-18-2024 06:01 AM

Join the Conversation

Re: SQS-Based-S3 Input for Cloudtrail black list e...