I have several files on a AWS s3 bucket and I have configured an input to get data from these files. Is there a way to make Splunk process them without unzip them manually ?
I use Splunk Enteprise 22.214.171.124 and AWS plugin.
Thanks for your help
I confirm that auto gzip files doesn' t work for me with the AWS add-on. Do I need to explicit it ?
Here is a sample input test entry for which it doesn't work
You can try looking at internal to find out the gzip files being downloaded from S3 before ingestion. Add-on will be able to do the auto extraction.
AWS Plugin you mean the AWS Add-on? Add-on does the extract internally and ingest the logs wihtout manual intervention. How is your gzip archive one file having all wrapped in them or they individually gzipped?
Have you tested it in test env?
Yes I mean AWS Add-on, files are individually gzipped. I tested it in a local test env.
I'll retry and keep you informed