So we are in a test environment. We have cloudtrail logs being generated from a Datagen source in Cribl. Those logs are being shipped to a Splunk Index Cluster via HEC (load balanced in Cribl to balance between the members). I have appended the field/value pair of sourceType/aws:cloudtrail and configured the HEC for the cluster inputs.conf to have the sourcetype of aws:cloudtrail. It appears as though my logs are not being indexed into the CIM format. One indicator is I think eventTtype: AwsApiCall should be event_type: AwsApiCall after going through the AWS add on. I have the add-on pushed to the cluster via the manager-apps and it shows up through the peer-apps on the indexers. Is there anything else I need to setup? ... View more