Query PutObject logs in Athena

Procedure

1. In Athena, Click "+" to add a new Query.

   

2. Copy the following query string to query panel.

    select count() as totalevent,
        eventname,
        SUBSTR(eventtime, 1, 13) as eventhour,
        json_extract(requestparameters, '$.bucketName') as bkt
    from cloudtrail_logs_<bucket_name>
    where eventname = 'PutObject' and errorcode is NULL
    group by eventname,
        json_extract(requestparameters, '$.bucketName'),
        SUBSTR(eventtime, 1, 13)
    order by eventhour
   

3. Replace from "cloudtrail_logs_<bucket_name → " with the table name in the "Tables".
4. Click Run or Run again.