Here is a quick query when you are looking for events in CloudTrail. First, export to Athena.
Then create a query that references the table: Now you are ready for some SQL

In the example below I am getting entries from “TableName” and the service is Amazon WorkSpaces. That has a source of workspaces.amazonaws.com

SELECT 
    eventsource,
    eventname
FROM TableName
WHERE eventsource = 'workspaces.amazonaws.com' 
ORDER by eventtime
LIMIT 100;