How to configure the Splunk App for AWS to index AWS Cloudtrail logs in s3 buckets from last year?

[Venkat_16]

Greetings everyone!!!!

We have configured Splunk app for AWS and everything is working perfectly. Now the AWS application team wants to onboard the logs of AWS cloudtrail for last year (i,e) from Jan 2015 to Dec 2015 which are available in the s3 buckets. Is adding the ignoreOlderThan = 1y in the inputs stanza of cloudtrail inputs.conf a healthy way of doing it? Please guide us on this further.

Thanks in advance!!!!!

[rpille_splunk · Accepted solution]

Hi Venkat_16. If your historical cloudtrail logs are in an S3 bucket, configure an S3 input to collect them and set the sourcetype for that input stanza to aws:cloudtrail. You can set the initial_scan_datetime parameter in the S3 input to one year ago (using ISO8601 formatting) to collect the specific historical range that you are after.

Here's the relevant add-on documentation: http://docs.splunk.com/Documentation/AddOns/latest/AWS/S3