https://community.splunk.com/t5/Getting-Data-In/Problem-blacklisting-single-subdirectory/m-p/107964#M22685 <P>benme, </P> <P>Are you sure you have not already indexed the directory prior to putting the blacklist in place? Splunk will keep the data in even if you later decide to blacklist the directory. </P> <P>Hope this helps.</P> <P><CODE>&gt; please upvote and accept answer if you find it useful - thanks!</CODE></P> Thu, 10 Nov 2011 04:15:36 GMT _d_ 2011-11-10T04:15:36Z https://community.splunk.com/t5/Getting-Data-In/Problem-blacklisting-single-subdirectory/m-p/107963#M22684 <P>I have universal forwarder 4.2.4 installed on a Windows 2008 server. I have it monitoring several directories, but I want to blacklist a single subdirectory, so all files in that subdirectory are ignored. I've tried the following in the inputs.conf file, but files in the subdirectory continue to be processed. </P> <PRE><CODE>[monitor:///$WINDIR\MyDirectory] blacklist = MySubDirectory [monitor:///$WINDIR\MyDirectory] blacklist = \MySubDirectory [monitor:///$WINDIR\MyDirectory] blacklist = \MySubDirectory\ [monitor:///$WINDIR\MyDirectory] blacklist = \MySubDirectory\* [monitor:///$WINDIR\MyDirectory] blacklist = \\MySubDirectory [monitor:///$WINDIR\MyDirectory] blacklist = \\MySubDirectory\\ [monitor:///$WINDIR\MyDirectory] blacklist = \\MySubDirectory\\* [monitor:///$WINDIR\MyDirectory] blacklist = /MySubDirectory [monitor:///$WINDIR\MyDirectory] blacklist = /MySubDirectory/ [monitor:///$WINDIR\MyDirectory] blacklist = /MySubDirectory/* </CODE></PRE> <P>and several other variations. I'm sure I'm missing something obvious. Thanks for the help.</P> Thu, 10 Nov 2011 00:17:45 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-blacklisting-single-subdirectory/m-p/107963#M22684 benme 2011-11-10T00:17:45Z https://community.splunk.com/t5/Getting-Data-In/Problem-blacklisting-single-subdirectory/m-p/107964#M22685 <P>benme, </P> <P>Are you sure you have not already indexed the directory prior to putting the blacklist in place? Splunk will keep the data in even if you later decide to blacklist the directory. </P> <P>Hope this helps.</P> <P><CODE>&gt; please upvote and accept answer if you find it useful - thanks!</CODE></P> Thu, 10 Nov 2011 04:15:36 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-blacklisting-single-subdirectory/m-p/107964#M22685 _d_ 2011-11-10T04:15:36Z https://community.splunk.com/t5/Getting-Data-In/Problem-blacklisting-single-subdirectory/m-p/107965#M22686 <P>Since this is presumably on Windows/NTFS, try to make your blacklist case-insensitive:</P> <PRE><CODE>blacklist = (?i)mysubdirectory </CODE></PRE> Thu, 10 Nov 2011 07:30:53 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-blacklisting-single-subdirectory/m-p/107965#M22686 gkanapathy 2011-11-10T07:30:53Z https://community.splunk.com/t5/Getting-Data-In/Problem-blacklisting-single-subdirectory/m-p/107966#M22687 <P>Did you try restarting the Universal Forwarder?</P> Thu, 10 Nov 2011 16:29:13 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-blacklisting-single-subdirectory/m-p/107966#M22687 _d_ 2011-11-10T16:29:13Z https://community.splunk.com/t5/Getting-Data-In/Problem-blacklisting-single-subdirectory/m-p/107967#M22688 <P>I ended up uninstalling and reinstalling universal forwarder. After that blacklist worked properly.</P> Thu, 10 Nov 2011 19:53:00 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-blacklisting-single-subdirectory/m-p/107967#M22688 benme 2011-11-10T19:53:00Z