Splunk Dev

Cloudtrail Log Input doesn't exist

cchsiang2002
Explorer

Hello,

I have installed the Splunk App for AWS. Billing and instance data are successfully being generated. I am looking to pull data from Cloudtrail next. After installation, the data input for AWS Cloudtrail Log does not appear. Splunk version is 6.0.2. Is there a config I am missing?

Thanks in advance.

Tags (1)
0 Karma
1 Solution

atanasoffa
Explorer

Solved - the issue is that the Splunk DBConnect app interferes with the modular input for Cloudtrail - so the input is hidden at https://[server_name]/en-US/manager/search/data/inputs/aws-cloudtrail. The fix is to update the DBConnect app if it exists and the Cloudtrail input will appear when navigating to Data Inputs.

View solution in original post

0 Karma

atanasoffa
Explorer

Solved - the issue is that the Splunk DBConnect app interferes with the modular input for Cloudtrail - so the input is hidden at https://[server_name]/en-US/manager/search/data/inputs/aws-cloudtrail. The fix is to update the DBConnect app if it exists and the Cloudtrail input will appear when navigating to Data Inputs.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...