You can move only that index to S3. But because there is no concept of warm/cold when using SmartStore/S3 you will be migrating the full index to S3. (Splunk will take care of caching and all.) ... View more

Thanks that helped,  At the end that was part of the issue and also that I was using the wrong sourcetype, looks like the Add-on was changing the sourcetype name.  The following post helped me as well.    https://community.splunk.com/t5/Splunk-Search/Easiest-way-to-exclude-ingestion-of-events-for-a-specific-IP/m-p/289350 ... View more