https://community.splunk.com/t5/Getting-Data-In/Can-you-blacklist-a-host/m-p/96129#M20013 <P>See if this setting in inputs.conf helps:</P> <P><CODE>followSymlink = [true|false]</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf</A></P> <P>d.</P> Fri, 21 Oct 2011 18:19:29 GMT _d_ 2011-10-21T18:19:29Z https://community.splunk.com/t5/Getting-Data-In/Can-you-blacklist-a-host/m-p/96128#M20012 <P>Here's the situation I'm trying to muddle through:</P> <P>We have a production server that inputs.conf is monitoring, all the files being monitored are in:</P> <PRE><CODE>[monitor:///log_comp1/scribed/*/*/*.log] index = production </CODE></PRE> <P>Then we have a separate qa server that inputs that conf is also monitoring:</P> <PRE><CODE>[monitor:///logs/scribed/*/*/*.log] index = qa </CODE></PRE> <P>The problem I am facing is that it turns out the production log server has a symlink on it for /logs/, which points to /log_comp1/</P> <P>So, the qa monitoring statement is picking up logs from the production symlink and indexing it in the qa index - basically this stuff is being indexed twice, and it's causing confusion when searching in the qa index, since it throws production data back.</P> <P>Is there a way to blacklist logs from the production server from being indexed by the qa monitoring statement? The directory names all all the same after /logs/scribed - so I can't use directory names in the blacklist, without accidentally blacklisting qa log data.</P> <P>Any suggestions?</P> Fri, 21 Oct 2011 16:03:28 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-blacklist-a-host/m-p/96128#M20012 hharvey 2011-10-21T16:03:28Z https://community.splunk.com/t5/Getting-Data-In/Can-you-blacklist-a-host/m-p/96129#M20013 <P>See if this setting in inputs.conf helps:</P> <P><CODE>followSymlink = [true|false]</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf</A></P> <P>d.</P> Fri, 21 Oct 2011 18:19:29 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-blacklist-a-host/m-p/96129#M20013 _d_ 2011-10-21T18:19:29Z https://community.splunk.com/t5/Getting-Data-In/Can-you-blacklist-a-host/m-p/96130#M20014 <P>hey, whaddaya know, it worked! <span class="lia-unicode-emoji" title=":winking_face:">😉</span> thank you for pointing out what I somehow missed while scouring that doc!</P> Fri, 21 Oct 2011 18:53:08 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-blacklist-a-host/m-p/96130#M20014 hharvey 2011-10-21T18:53:08Z