topic Re: blacklist events from log file in Getting Data In

blacklist events from log file

newbiesplunk — Mon, 11 May 2015 10:31:38 GMT

Hi,
I wish to exclude certain events not to forward to indexer, as below. How to configure that? thks & rgds

.......Directory=.....
....Module=abc....

Re: blacklist events from log file

krish3 — Mon, 11 May 2015 10:57:48 GMT

I believe you are looking something like eventlog filtering.

Checkout EventLog filtering using inputs.conf here

Re: blacklist events from log file

Runals — Mon, 28 Sep 2020 19:56:14 GMT

There are a couple ways to do that but if you could flesh out some examples of what you are talking about it would be easier to help. The closest thing to the data is generally preferred/the best. That would be done with using blacklist in an an inputs.conf on the forwarder. That would be placed in $SPLUNK_HOME/etc/system/local OR could be pushed out by a deployment server in which case they would live in $SPLUNK_HOME/etc/apps/<your app>/local/

Exclude: /var/log/foo

[monitor::///var/log]
blacklist = foo