We have updated our Terms of Service, Code of Conduct, and Addendum.

For CloudTrail, how would I format a query to look for the follow pattern?

Steve Litras
Steve Litras Posts: 12 admin
edited September 2023 in General Discussions

Hello.  I have a basic CloudTrail bucket and would like to have the account number part of the bucket path be able to be specified in a Cribl Search.
How would I format a search query that looks for “account” 12345 if the path is as follows. …/AWSLogs/${account}/CloudTrail/…

Tagged:

Best Answer

Answers

  • dritan
    dritan Posts: 51 ✭✭
    Answer ✓

    dataset=mydataset account=12345

  • Steve Litras
    Steve Litras Posts: 12 admin

    That's what I figured it would be, but wasn't seeing results. I let it run for 30 seconds this time and it showed results after I cancelled the search.

  • dritan
    dritan Posts: 51 ✭✭

    oh, maybe some ui refresh issues?

  • Steve Litras
    Steve Litras Posts: 12 admin

    It must have been, but It's working now. just taking a bit longer than I was allowing it to run. Thanks for helping confirm/sanity check for me :slightly_smiling_face:

Categories