topic blacklist in batch stanza in Getting Data In

blacklist in batch stanza

carmackd — Wed, 19 May 2010 02:51:28 GMT

Can I use blacklist in a batch stanza? I couldn't find anything in the documentation saying otherwise.

Thanks,

Re: blacklist in batch stanza

netwrkr — Wed, 19 May 2010 22:11:48 GMT

According to what I read, the answer is no.

"Use whitelist and blacklist rules to explicitly tell Splunk which files to consume when monitoring directories."

http://www.splunk.com/base/Documentation/4.1.2/Admin/Whitelistorblacklistspecificincomingdata

Re: blacklist in batch stanza

Mick — Thu, 20 May 2010 03:00:51 GMT

The answer is actually yes, you should be able to use white & blacklist settings for sinkhole directories (batch inputs). The underlying logic is the same for both monitor and batch inputs, the only difference being that batch is destructive and will delete your data.

I'll get the docs updated to reflect this.