diff --git a/cloudtrail/generate_splunk.cloudtrail.tf b/cloudtrail/generate_splunk.cloudtrail.tf
index 159e9dd..a61110a 100644
--- a/cloudtrail/generate_splunk.cloudtrail.tf
+++ b/cloudtrail/generate_splunk.cloudtrail.tf
@@ -25,6 +25,6 @@ resource "null_resource" "splunk_cloudtrail" {
   }
   provisioner "local-exec" {
     working_dir = "setup"
-    command     = "echo '${data.template_file.splunk_cloudtrail.rendered}' > inputs.cloudtrail.${local.account_id}.${local.region}.conf"
+    command     = "echo '${data.template_file.splunk_cloudtrail.rendered}' > inputs.${local.splunk_name}.${local.account_id}.${local.region}.conf"
   }
 }
diff --git a/cloudtrail/main.tf b/cloudtrail/main.tf
index 83f5c6f..be9b9af 100644
--- a/cloudtrail/main.tf
+++ b/cloudtrail/main.tf
@@ -67,6 +67,8 @@ locals {
 
   role_name   = format("%v%v", local._prefixes["role"], local.name)
   policy_name = format("%v%v", local._prefixes["policy"], local.name)
+
+  splunk_name = var.enable_organization ? "org-cloudtrail" : "cloudtrail"
 }
 
 data "aws_kms_key" "incoming_key" {