We're running into an issue using Add-On for AWS + SQS-based S3 inputs to pull Aurora logs from S3 buckets. The .gz data in the buckets appears "double zipped" so even after Splunk extracts and indexes the data our search results are still zipped & look like this: ��G�!x��#�V�~������ ��D����;~-lǯ=�������D�
AWS admins confirmed logs are zipped just once by Kinesis en route to S3 buckets (not a .zip containing groups of .gz), but even extracting data directly from journal.gz on indexers doesn't reveal plaintext logs.
Any potential solutions/fixes for this?
