topic Re: Exclude tar files in inputs.conf in Getting Data In

Exclude tar files in inputs.conf

tevgey23 — Tue, 29 Oct 2013 20:52:19 GMT

Hello,

Is there a way to "blacklist" or exclude tar.gz file with in a monitored directory in
the inputs.conf file.

For example.. I would like to monitoring /var/log/syslog/*
but not all the rotated tar files which have been created.
Just the .log file which have been created that day

Re: Exclude tar files in inputs.conf

jtrucks — Tue, 29 Oct 2013 21:29:46 GMT

The docs at http://docs.splunk.com/Documentation/Splunk/6.0/admin/Inputsconf show under the Monitor section:

blacklist =
* If set, files from this input are NOT monitored if their path matches
the specified regex.
* Takes precedence over the deprecated _blacklist attribute, which functions the same way.

So in your case:

blacklist = *.tar.gz

Re: Exclude tar files in inputs.conf

tevgey23 — Tue, 29 Oct 2013 21:31:52 GMT

Nice.. Thank you

Re: Exclude tar files in inputs.conf

jtrucks — Tue, 29 Oct 2013 21:36:44 GMT

Don't forget to mark it as accepted/answered!

Re: Exclude tar files in inputs.conf

ChrisG — Tue, 29 Oct 2013 21:45:01 GMT