Why is an AWS S3 Bucket with .zip Files not getting indexed in Splunk Cloud?

[yoni1887]

I'm a bit of a noob so any help here would be greatly appreciated.

I have buckets in S3 with .log files contained in .zip files. For some season Splunk (Splunk Cloud) isn't extracting the .zip files and indexing the contained .log files. Any ideas why this would be? When I upload one of the .log files within a .zip file individually it gets indexed beautifully. It was my understanding that Splunk should have no problem indexing files within .zip files.

Thanks in advance!

[czheng]

According to Splunk doc, it just does not support .zip file on S3 bucket. Refer to the list of supported compressed file format at #4 about this:
http://docs.splunk.com/Documentation/AddOns/released/AWS/ConfigureInputs#S3_inputs

[esix_splunk]

Validate your inputs, and make sure that the .zip files are not blacklisted. Most likely they are due to processing and member requirements associated with un/archiving files in the queues.