How to configure cloudwatch logs as an input for Linux Auditd app?

[achakote]

We have forwarded our audit.log files to cloudwatch logs as {hostname}/audit.log. For Linux Auditd (TA_linux-auditd) app we have configured inputs.conf as below

 [monitor://*/audit.log]
 disabled = false 
 sourcetype = aws:cloudwatchlogs 

But i don't see any data getting updated in the Linux Auditd app.

Any suggestions.

[Klimdy]

really will be cool, if you paste splunkd.log where you have WARN or ERROR message about it))