Splunk add-on for AWS: In a generic S3 input, can a key-prefix contain a wildcard?

[travislelledeep]

Trying to use a key-prefix when setting up a Generic S3 input that utilizes a wildcard in the path, but it doesn't look to be working.

S3 key prefix = /AWSLogs/*/vpcflowlogs/

Has anyone had any luck in setting this up before?

[ColinJacksonPS]

I'm trying to do the same thing. Anyone hear anything? 

[travislelledeep]

Also to clarify - since it doesn't appear I can edit my post - this was setup via the GUI, so ignore the inputs.conf-like formatting of my example, since this wasn't setup in a .conf file, I was just representing what I used for my S3 key prefix.

[mpresseau]

Did you resolve this? I have a similar issue trying to find the proper format for this field. Not sure if prefix means part of a file, or the folder within a bucket to be looking at....

I have logs/ in that field, thinking that it is grabbing that folder but it is pulling hundreds of GB from S3, even though there are only 2GB worth of compressed log files in that folder...

Hope you found something?