topic Re: Question about blacklist entry in Getting Data In

Question about blacklist entry

jangid — Thu, 31 May 2012 13:18:14 GMT

I want to exclude all files that contain some keyword from splunk forwarder, I have added an entry in prop.conf.

[monitor:/home/default/log]
blacklist = (WARNING|FATAL|ERROR$)

but still my search result return some file that contain WARNING keyword in the file name.

can you please tell me what is the wrong here?

sdaniels — Thu, 31 May 2012 13:36:57 GMT

It may need to be (WARNING.*|FATAL|ERROR$) in your regex. Is the file name only WARNING or can it contain other characters at the end?

jangid — Thu, 31 May 2012 13:42:27 GMT

Thanks sdaniels