https://community.splunk.com/t5/Getting-Data-In/need-help-setting-up-a-blacklist/m-p/38823#M7180 <P>Hi guys, </P> <P>Trying to make a custom blacklist for one of my input monitor points that excludes certain directories and filetypes (gz). </P> <P>This is when I have so far:</P> <H2>inputs.conf</H2> <PRE><CODE>[default] host = myhost [monitor:///my_monitor_point] disabled = false blacklist = (subfolder1|subfolder2|subfolder3|subfolder4|\.gz$|\.\d+$) index = my_index sourcetype = my_source_type </CODE></PRE> <P>Can someone confirm if this is the correct way to do this?</P> <P>Thanks. </P> <P>Brian</P> Wed, 06 Jul 2011 23:26:13 GMT balbano 2011-07-06T23:26:13Z https://community.splunk.com/t5/Getting-Data-In/need-help-setting-up-a-blacklist/m-p/38823#M7180 <P>Hi guys, </P> <P>Trying to make a custom blacklist for one of my input monitor points that excludes certain directories and filetypes (gz). </P> <P>This is when I have so far:</P> <H2>inputs.conf</H2> <PRE><CODE>[default] host = myhost [monitor:///my_monitor_point] disabled = false blacklist = (subfolder1|subfolder2|subfolder3|subfolder4|\.gz$|\.\d+$) index = my_index sourcetype = my_source_type </CODE></PRE> <P>Can someone confirm if this is the correct way to do this?</P> <P>Thanks. </P> <P>Brian</P> Wed, 06 Jul 2011 23:26:13 GMT https://community.splunk.com/t5/Getting-Data-In/need-help-setting-up-a-blacklist/m-p/38823#M7180 balbano 2011-07-06T23:26:13Z https://community.splunk.com/t5/Getting-Data-In/need-help-setting-up-a-blacklist/m-p/38824#M7181 <P>yes, the above will work. However, it's probably unnecessary to specify the <CODE>host</CODE> as it will be inherited or derived from the local machine name, unless you need it to be different. If you do, it may make sense to specify it under the [monitor] stanza rather than [default], but really it depends on the rest of your usage.</P> <P>Note that your blacklist might be too broad, e.g., if one of your subfolders is called "bin", then you will also exclude any file named "binary.log" as well as everything in a directory named "bingo". You'd need to make your regex more specific if you want to avoid that happening.</P> Thu, 07 Jul 2011 03:45:42 GMT https://community.splunk.com/t5/Getting-Data-In/need-help-setting-up-a-blacklist/m-p/38824#M7181 gkanapathy 2011-07-07T03:45:42Z