topic Re: blacklist a string during file monitoring in Getting Data In

blacklist a string during file monitoring

Ashker — Wed, 07 Aug 2024 12:03:04 GMT

Hi Team,

I am monitoring blucoat proxy logs via syslog log collection method. My input.conf file is configured to read all logs inside the location opt/splunk/syslog/symantec/bluecoat/*/*.log. below is the current configuration. Now i need to exclude the log which have cs-host=nxtengine.cpga.net.qa from indexing.

[monitor:///opt/splunk/syslog/symantec/bluecoat/*/*.log] sourcetype = bluecoat:proxysg:access:syslog index = cus_XXX host_segment = 6 disabled = false

Sample raw logs below

Re: blacklist a string during file monitoring

PickleRick — Wed, 07 Aug 2024 12:24:15 GMT

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

Re: blacklist a string during file monitoring

richgalloway — Wed, 07 Aug 2024 15:16:01 GMT

Inputs settings can determine which files to monitor, but cannot filter events out of monitored files. To do that, you need to use props and (optionally) transforms on an indexer or heavy forwarder.

Re: blacklist a string during file monitoring

JohnEGones — Wed, 07 Aug 2024 17:05:56 GMT

This may also be useful, you can let the already logged files remain and just refine the inputs conf to exclude the logs you don't want monitored and ingested.

https://community.splunk.com/t5/Getting-Data-In/How-to-blacklist-inputs-conf/td-p/598999

In addition to PickleRick's DOC suggestion:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/InputsConf#MONITOR: