Given a Splunk environment with SQS (S3) as the data source, is it possible to "filter" messages at so that we can separate each file (based on its prefix) to different Splunk indexes?
Put another way, if we have 25 indexes, corresponding to 25 different data types in an S3 bucket, and we want to use S3 and SQS, can we configure Splunk to conditionally index the data based on a path/prefix match pattern applied to each SQS message?
