How to add blacklist in inputs.conf file using Linux Command

chris1 — Thu, 10 Sep 2015 06:28:19 GMT

Hi ,

We have a Splunk forwarder installed on a Linux platform. I have already added the monitor details in inputs.conf file. Now I want to avoid the files which have "test" in the name. So I need to add blacklist = test in inputs.conf file. Please let me know how to add it.

e;g ./splunk edit monitor

Re: How to add blacklist in inputs.conf file using Linux Command

lcrielaa — Thu, 10 Sep 2015 07:41:13 GMT

You can't. See here for all the options you can do via the CLI:
http://docs.splunk.com/Documentation/Splunk/6.2.5/Data/MonitorfilesanddirectoriesusingtheCLI

Adding a blacklist isn't one of them. You could probably do it with some regex/sed-magic. You could search for you particular monitoring stanza and add the blacklist line underneath it and then restart splunk. This should help: http://stackoverflow.com/questions/15559359/insert-line-after-first-match-using-sed

topic How to add blacklist in inputs.conf file using Linux Command in Getting Data In

How to add blacklist in inputs.conf file using Linux Command

Re: How to add blacklist in inputs.conf file using Linux Command