topic Re: Why am I unable to blacklist all content in a certain directory with my current inputs.conf? in Getting Data In

Why am I unable to blacklist all content in a certain directory with my current inputs.conf?

anaqvi — Thu, 03 Nov 2016 16:49:03 GMT

I am trying to blacklist the following in the inputs.conf

Currently I have this:

[monitor:///var/log]
disabled = false
blacklist = /manager/tomatod*
index = os

I have tried to blacklist all content that in the manager directory containing "tomatod" from ingesting.

So far I have had no luck. The inputs.conf file is put into a deployment-app. Not sure what I am doing wrong. Please advise..

Re: Why am I unable to blacklist all content in a certain directory with my current inputs.conf?

somesoni2 — Thu, 03 Nov 2016 17:05:47 GMT

Blacklist uses regex and you would need to escape those forward slashes. Try this

[monitor:///var/log]
disabled = false
blacklist = \/manager\/tomatod.*
index = os

Re: Why am I unable to blacklist all content in a certain directory with my current inputs.conf?

anaqvi — Thu, 03 Nov 2016 17:18:13 GMT

That did not work. It is still generating events. :(...any other suggestion?

Re: Why am I unable to blacklist all content in a certain directory with my current inputs.conf?

somesoni2 — Thu, 03 Nov 2016 17:22:14 GMT

The blacklist works on the file name (not the file content), so could you provide the full path of the file that you want to exclude?

Re: Why am I unable to blacklist all content in a certain directory with my current inputs.conf?

anaqvi — Tue, 29 Sep 2020 11:39:08 GMT

I want to blacklist everything that contains prefix "tomatod"

/var/log/manager/tomatod.log

/var/log/manager/tomatod_portfolios.log
/var/log/manager/tomatod_portfolios_preview.log
/var/log/manager/tomatod_preview.log

/var/log/manager/tomatod_tickers.log

/var/log/manager/tomatod_tickers_preview.log

Re: Why am I unable to blacklist all content in a certain directory with my current inputs.conf?

hunters_splunk — Thu, 03 Nov 2016 20:01:31 GMT

Hi anaqvi,

Aside from escaping the forward slashes, you may also need to indicate any characters before and after your specified text:

 [monitor:///var/log]
 disabled = false
 blacklist = \/manager\/.*tomatod.*
 index = os

Hope it works. Thanks!
Hunter

Re: Why am I unable to blacklist all content in a certain directory with my current inputs.conf?

anaqvi — Thu, 03 Nov 2016 20:19:38 GMT

I tried that but still no luck 😞

Re: Why am I unable to blacklist all content in a certain directory with my current inputs.conf?

anaqvi — Fri, 04 Nov 2016 17:45:17 GMT

Any other recommendations in resolving this issue?

Re: Why am I unable to blacklist all content in a certain directory with my current inputs.conf?

jbarlow_splunk — Fri, 09 Jun 2017 06:08:23 GMT

[monitor:///home/splunk]
disabled = false
blacklist = \/home\/splunk\/anotherdir\/
sourcetype = sbblacklist

and files within /home/splunk/anotherdir/
were excluded okay

Turning DEBUG on for log channel TailingProcessor also confirmed match blacklist
DEBUG TailingProcessor - Not using stanza for this item (Matched blacklist '\/home\/splunk\/anotherdir\/'.).