topic Re: How to exclude some specific files in a monitored Source folder from being indexed? in Getting Data In

How to exclude some specific files in a monitored Source folder from being indexed?

Abilan1 — Mon, 24 Aug 2015 16:28:33 GMT

Hi,

I have added my log folder in Splunk monitoring. I want to exclude the files that start with Test from Splunk monitoring. Is it possible? Please suggest me a solution on this. There are so many unwanted files that are getting created in that log folder and it is getting uploaded into Splunk and affecting daily license usage.

Thanks!

Re: How to exclude some specific files in a monitored Source folder from being indexed?

jensonthottian — Mon, 24 Aug 2015 17:16:53 GMT

Configure your exclusion in props.conf file :

To exclude this file from being picked up by the forwarder, I think you can use a blacklist http://docs.splunk.com/Documentation/Splunk/6.2.5/Data/Whitelistorblacklistspecificincomingdata

[monitor:///directory]
blacklist = (test$)

Re: How to exclude some specific files in a monitored Source folder from being indexed?

Abilan1 — Mon, 24 Aug 2015 17:48:25 GMT

Hi,

I think we need to update in inputs.conf right? Also I tried blacklist = (test$) it is not working as expected. am still seeing the test files in Splunk.

Re: How to exclude some specific files in a monitored Source folder from being indexed?

jensonthottian — Mon, 24 Aug 2015 17:55:48 GMT

my bad- it would be inputs.conf for blacklisting.

[monitor:///pathtologdir]
blacklist=Test

And that will not index files that contain strings matching "Test".

Please remember to restart your splunkd.

Re: How to exclude some specific files in a monitored Source folder from being indexed?

Abilan1 — Mon, 24 Aug 2015 18:01:41 GMT

Hi ,

Thanks! it rejects only file names with name Test right? or it search content of all files also?

Re: How to exclude some specific files in a monitored Source folder from being indexed?

Abilan1 — Mon, 24 Aug 2015 18:54:12 GMT

Hi,

Thank you so much for your help. Please confirm, it rejects only file names with Test or it will look for files content as well?

Re: How to exclude some specific files in a monitored Source folder from being indexed?

jensonthottian — Mon, 24 Aug 2015 19:02:01 GMT

It will reject all.
for only files use this :

blacklist=Test.*

Re: How to exclude some specific files in a monitored Source folder from being indexed?

jensonthottian — Mon, 24 Aug 2015 19:03:47 GMT

\ frontslash in between "t" and "."

Re: How to exclude some specific files in a monitored Source folder from being indexed?

Abilan1 — Tue, 25 Aug 2015 06:15:49 GMT

Hi ,

I have tested with the files which has "test" in word, but the file name is sample.txt and it is uploaded into splunk. So I think it is not looking into the content, only file name.