https://community.splunk.com/t5/Splunk-Search/Splunk-add-on-for-AWS-In-a-generic-S3-input-can-a-key-prefix/m-p/489530#M136727 <P>Did you resolve this? I have a similar issue trying to find the proper format for this field. Not sure if prefix means part of a file, or the folder within a bucket to be looking at....</P> <P>I have logs/ in that field, thinking that it is grabbing that folder but it is pulling hundreds of GB from S3, even though there are only 2GB worth of compressed log files in that folder...</P> <P>Hope you found something?</P> Mon, 13 Jan 2020 20:14:22 GMT mpresseau 2020-01-13T20:14:22Z https://community.splunk.com/t5/Splunk-Search/Splunk-add-on-for-AWS-In-a-generic-S3-input-can-a-key-prefix/m-p/489528#M136725 <P>Trying to use a key-prefix when setting up a Generic S3 input that utilizes a wildcard in the path, but it doesn't look to be working.</P> <PRE><CODE>S3 key prefix = /AWSLogs/*/vpcflowlogs/ </CODE></PRE> <P>Has anyone had any luck in setting this up before?</P> Tue, 24 Sep 2019 16:06:30 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-add-on-for-AWS-In-a-generic-S3-input-can-a-key-prefix/m-p/489528#M136725 travislelledeep 2019-09-24T16:06:30Z https://community.splunk.com/t5/Splunk-Search/Splunk-add-on-for-AWS-In-a-generic-S3-input-can-a-key-prefix/m-p/489529#M136726 <P>Also to clarify - since it doesn't appear I can edit my post - this was setup via the GUI, so ignore the inputs.conf-like formatting of my example, since this wasn't setup in a .conf file, I was just representing what I used for my S3 key prefix.</P> Tue, 24 Sep 2019 16:27:18 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-add-on-for-AWS-In-a-generic-S3-input-can-a-key-prefix/m-p/489529#M136726 travislelledeep 2019-09-24T16:27:18Z https://community.splunk.com/t5/Splunk-Search/Splunk-add-on-for-AWS-In-a-generic-S3-input-can-a-key-prefix/m-p/489530#M136727 <P>Did you resolve this? I have a similar issue trying to find the proper format for this field. Not sure if prefix means part of a file, or the folder within a bucket to be looking at....</P> <P>I have logs/ in that field, thinking that it is grabbing that folder but it is pulling hundreds of GB from S3, even though there are only 2GB worth of compressed log files in that folder...</P> <P>Hope you found something?</P> Mon, 13 Jan 2020 20:14:22 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-add-on-for-AWS-In-a-generic-S3-input-can-a-key-prefix/m-p/489530#M136727 mpresseau 2020-01-13T20:14:22Z https://community.splunk.com/t5/Splunk-Search/Splunk-add-on-for-AWS-In-a-generic-S3-input-can-a-key-prefix/m-p/537301#M151876 <P>I'm trying to do the same thing. Anyone hear anything?&nbsp;</P> Tue, 26 Jan 2021 20:47:56 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-add-on-for-AWS-In-a-generic-S3-input-can-a-key-prefix/m-p/537301#M151876 ColinJacksonPS 2021-01-26T20:47:56Z