topic Re: Blacklist directories? in Getting Data In

Blacklist directories?

ustun — Tue, 12 Apr 2011 06:04:31 GMT

I'm missing something here:

blacklist = (samba|yum|.gz)

samba is a directory, the others are files.

splunk still tries to monitor samba here, I see it in the output of "splunk list monitor". Also splunkd.log says permission denied for samba, which means it's not ignoring it.

What am I missing? Is there a problem with the regex?

Ustun

Re: Blacklist directories?

mamaral — Tue, 12 Apr 2011 08:46:37 GMT

try it that: lacklist.0 = complete path of samba folder lacklist.1 = *yum lacklist.2 = *.gz

Amaral

Re: Blacklist directories?

ustun — Tue, 19 Apr 2011 23:42:19 GMT

It didn't work that way either, I don't see a problem with this simple regex. I guess something else is going on. Will update once resolved.

Ustun

Re: Blacklist directories?

akocak — Thu, 11 May 2017 17:31:19 GMT

I haven't seen any example that you can blacklist directory yet

Re: Blacklist directories?

dantimola — Wed, 26 Jul 2017 04:32:31 GMT

This answer is late, but for this problem you can just add the stanza below for your inputs.conf

[blacklist://<path>]

Cheers,
Dan