Getting logs from S3 to Splunk

[spl_unker]

Hi Splunkers ,

We have decided to use S3 as centralized collection of logs from various sources. I have the following questions to have have the best way to get data into Splunk from S3.  Daily ingestion of logs will be around 5 Gb. There will be multiple inputs needs to be created to read each s3 buckets.

Questions :

1. I see there are 2 Addon's available.  Splunk Add-on for AWS and  Splunk Add-on for Amazon Kinesis Firehose. Will both Add-on supports reading data from s3? If so which is the best method?

2. Splunk Add on Aws has 3 input types : Generic S3 , Incremental S3 , SQS based S3. Which will be the best method to ingest data from multiple directories and around 5Gb per day.

3. Recommended hardware for Heavy forwarder.

Thanks in Advance.