Reading AWS s3 gz files without extension in Splunk?

[prash]

I am having difficulties to get Splunk to ingest gzipped logs files from an S3 bucket, the files itself do not have extensions and Splunk is reading them as binaries.

I tried archive_cmd to auto, gunzip -c, gzip -d in props.conf with no luck

[source::/xxx/*]

unarchive_cmd = gunzip -c

NO_BINARY_CHECK = true

gunzip -c works in shell, gzip -d doesn't without gz suffix

*using AWS addon

due to the nature of the environment, the files can't be renamed. Anyone experienced this before?

[prash]

I did try that, made no difference. As per docs, the unarchive_cmd is only invoked when invalid_cause is specified.

[richgalloway]

I noticed the contradiction in the docs.  I suggest contacting Splunk Support.

[richgalloway]

Have you tried adding invalid_cause=archive to the stanza?  The docs have conflicting information about it, but it's worth a try.