Here is a quick query when you are looking for events in CloudTrail. First, export to Athena.
Then create a query that references the table: Now you are ready for some SQL
In the example below I am getting entries from “TableName” and the service is Amazon WorkSpaces. That has a source of workspaces.amazonaws.com
SELECT eventsource, eventname FROM TableName WHERE eventsource = 'workspaces.amazonaws.com' ORDER by eventtime LIMIT 100;