• A role on your Splunk Cloud Platform deployment that has the admin_all_objects capability.
• Datasets in your Amazon S3 buckets that are composed entirely of AWS CloudTrail data.
• You must have already defined an Amazon S3 federated provider that is set up for the creation of Splunk-managed AWS Glue tables. See Define an Amazon S3 federated provider.

1. On your Splunk Cloud Platform deployment, in Splunk Web, at the Set up federated index step of the Add a new Amazon S3 provider workflow, use the following table to specify the settings for your federated index.
   Note: You might also come to this collection of new federated index settings when you edit a federated provider or select Add federated index on the Federated indexes list page.

   Setting	Description
   Federated index name	Enter a unique name for the federated index. Federated index names have the following restrictions: They can contain only letters, numbers, underscores, and hyphens. They must begin with a letter or number. They cannot be more than 2,048 characters in length. They cannot be named kvstore. You can use this string in a longer name, like abc_kvstore.
   Dataset type	Select AWS Glue table (Splunk managed: CloudTrail).
   Amazon S3 location	Select the Amazon S3 location path for the AWS CloudTrail log dataset that you will search with this federated index. Splunk software will create an AWS Glue table which represents this dataset, and the federated index will map to that AWS Glue table. Amazon S3 location lets you select from a set of Amazon S3 location paths that is equivalent to the list of Amazon S3 locations in the definition for the federated provider the federated index is associated with. For AWS CloudTrail log datasets, the location path must end at the AWSLogs/ folder. If the location path you seek does not end at the AWSLogs/ folder you may need to fix it in the definition for the federated provider with which this index is associated. See Supply correctly-formatted Amazon S3 locations for Splunk-managed AWS Glue table generation.
   Time settings	The time settings define the time field for the dataset to which the federated index maps. Because AWS CloudTrail log datasets have a stable schema, the time settings have default values that you cannot change. The default event Time field is eventtime.
   Time partitions	The time partition settings determine the fields by which the dataset to which the federated index maps is partitioned by time. Because AWS CloudTrail log datasets have a stable schema, we can provide one default partition key that represents the three partition keys supported by CloudTrail log datasets: year, month, and day. The default Time partition field is pk_timestamp.
   Max search time range	Specify the maximum relative time range within which searches of the AWS CloudTrail log dataset return results. Max search time range applies to the time partitions in your data. For example, if you set a search that looks for the last 3 years in terms of time partitions and Max search time range is set to 1 year, your search returns results only for data within the last year partition. Federated searches with time ranges of 2 years or more might suffer from reduced search performance. If you occasionally need to run searches over data that is older than the Max search time range, consider setting up additional federated indexes with larger Max search time range values. For example, you might run most of your searches over a federated index with a Max search time range of 1 year. But you very occasionally have to run searches over data that is between 1 and 2 years of age, and for those searches you can set up a second federated index with a Max search time range of 2 years.
   AWS account IDs	Provide the 12-digit AWS account IDs by which the AWS CloudTrail log dataset to which this federated index maps is partitioned. You must provide at least 1 AWS account ID. Alternatively, you can provide a wildcard symbol (*) to partition the dataset by all available AWS account IDs. Note: When you use a wildcard symbol for AWS account IDs in a federated index definition, you must include a WHERE clause that filters results by pk_account_id when you invoke that federated index in an sdselect search. See sdselect command WHERE clause operations. For more information about obtaining AWS account IDs by which AWS CloudTrail log datasets are partitioned, see Identify partitions to optimize searches of AWS CloudTrail log datasets.
   AWS regions	Provide the AWS region by which the AWS CloudTrail log dataset to which this federated index maps is partitioned. You must provide at least 1 AWS region. Alternatively, you can provide a wildcard symbol (*) to partition the dataset by all available AWS regions. Note: When you use a wildcard symbol for AWS regions in a federated index definition, you must include a WHERE clause that filters results by pk_region when you invoke that federated index in an sdselect search. See sdselect command WHERE clause operations. For more information about obtaining AWS regions by which AWS CloudTrail log datasets are partitioned, see Identify partitions to optimize searches of AWS CloudTrail log datasets.

2. Select Save to save the federated index configuration.
3. (Optional) Give your users access to the federated index. To run searches over the remote dataset to which the federated index maps, your users must have access permissions for the federated index. See Give your users role-based access control of federated indexes.

Partitioning is an organization strategy for large datasets that makes it possible for you to search them efficiently. When you partition your data, you organize it into a hierarchical directory structure based on the distinct values of 1 or more fields in the data. Files in AWS CloudTrail log datasets are partitioned by time, meaning they are organized into folders by year, month, and day. This means all of the files associated with a specific date can easily be searched for.

Because AWS CloudTrail log datasets have a stable schema, definitions for federated indexes that map to Splunk-managed AWS Glue tables come with default partition time field values that you cannot change.

However, all AWS CloudTrail log datasets are also partitioned by two other fields (or "keys"): AWS account ID and AWS region. Splunk software cannot predict the values for these partition keys, so it is up to you to supply them. When you identify the partition keys in the federated index definition, you can run efficient and cost-effective sdselect searches of the AWS CloudTrail log dataset to which the federated index maps.

After you set up federated indexes that map to AWS Glue tables for AWS CloudTrail log datasets, you can use the sdselect command to search those datasets. See sdselect command overview.

You can delete a federated index that maps to an AWS Glue table that you no longer need to search. You can also delete federated indexes when your data scanning entitlements are depleted, to prevent unintentional usage.