About akkermansie

akkermansie · ‎01-15-2026

We have not configured the log_file_prefix argument and the sourcetype is set to aws:cloudtrail. I suspect that indexing CloudTrail events directly from an S3 bucket using the aws:cloudtrail sourcetype may only support CloudTrail Management Events. Other event types, such as Data Events or Network Activity events, might not be fully supported in this configuration. But I cannot find anything in the docs about this.

akkermansie · ‎01-14-2026

Why we would need a new input for this? All of our logs are stored in a single S3 bucket (including Management events and Network activity events). AWSLogs/<org_id>/<account_id>/CloudTrail/<logs> AWSLogs/<org_id>/<account_id>/CloudTrail-NetworkActivity/<logs> If we would create a new input, how would we make sure that input would only process Network Activity events?

akkermansie · ‎01-14-2026

We are receiving and ingesting the Management events. As described in my first message, the issue is related to ingesting Network Activity. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-network-events-with-cloudtrail.html

akkermansie · ‎01-14-2026

We recently enabled Network Activity Events on our Organizational CloudTrail, and the logs are being delivered to an S3 bucket. Despite logs being delivered to S3, Splunk does not process or index these events, and queries return no results. The network activity logs are stored in the following path format: AWSLogs/<org_id>/<account_id>/CloudTrail-NetworkActivity/ We are using Splunk version 7.10.0 and don't see any errors in the logs.

Posts	4
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎01-14-2026

Online Status	Offline
Date Last Visited	‎01-14-2026 07:26 AM

CloudTrail Network Activity events not processed v...

Re: CloudTrail Network Activity events not process...

Re: CloudTrail Network Activity events not process...

Re: CloudTrail Network Activity events not process...

CloudTrail Network Activity events not processed v...

Join the Conversation

CloudTrail Network Activity events not processed v...

Re: CloudTrail Network Activity events not process...

Re: CloudTrail Network Activity events not process...

Re: CloudTrail Network Activity events not process...

CloudTrail Network Activity events not processed v...