We are using Splunk Enterprise on AWS environment. So long back there is an Cloudtrial app configured on the same. Logs are directly getting pushed to splunk indexer through S3 bucket based on the inputs configured on the Coudtrial app. Since this App version is old, there is no option to configure the inputs through GUI. we are making changes through inputs.conf file itself.
I've to block the Decrypt logs (.gz) getting indexed from the splunk. please suggest the work around for the same. Let us know if this cloud trial App has to be upgraded for the same and what will be the latest version of this.