Greetings everyone!!!!
We have configured Splunk app for AWS and everything is working perfectly. Now the AWS application team wants to onboard the logs of AWS cloudtrail for last year (i,e) from Jan 2015 to Dec 2015 which are available in the s3 buckets. Is adding the ignoreOlderThan = 1y
in the inputs stanza of cloudtrail inputs.conf a healthy way of doing it? Please guide us on this further.
Thanks in advance!!!!!
Hi Venkat_16. If your historical cloudtrail logs are in an S3 bucket, configure an S3 input to collect them and set the sourcetype for that input stanza to aws:cloudtrail. You can set the initial_scan_datetime parameter in the S3 input to one year ago (using ISO8601 formatting) to collect the specific historical range that you are after.
Here's the relevant add-on documentation: http://docs.splunk.com/Documentation/AddOns/latest/AWS/S3
Hi Venkat_16. If your historical cloudtrail logs are in an S3 bucket, configure an S3 input to collect them and set the sourcetype for that input stanza to aws:cloudtrail. You can set the initial_scan_datetime parameter in the S3 input to one year ago (using ISO8601 formatting) to collect the specific historical range that you are after.
Here's the relevant add-on documentation: http://docs.splunk.com/Documentation/AddOns/latest/AWS/S3