topic Re: Stop Splunk To Read files in Monitoring Splunk

Stop Splunk To Read files

Prakash493 — Wed, 30 Sep 2020 01:09:59 GMT

Hi , currently i need splunk to stop reading the log files from below source location , i updated disabled=true to stop splunk to read files but it still reading and added the blacklist stanza too but nothing works , splunk is still reading and indexing files , Please tell me how can i stop splunk to read the below entire source path ?

[monitor://C:\UCX\dotnet\UCXWinPortal\logs...\Pinnacle_AX_*.log]
disabled = true
recursive = false
index = xxxxx
sourcetype = xxxxx
blacklist = .(log)$

Re: Stop Splunk To Read files

493669 — Tue, 02 Jul 2019 16:29:00 GMT

Hi @Prakash493,
Try below in inputs.conf-

[monitor://C:\UCX\dotnet\UCXWinPortal\logs...\Pinnacle_AX_*.log]
disabled = 1

Also You can disable from UI
go to the Web UI -> Settings - Data Inputs -> Files and Directories -> Disable particular input

Re: Stop Splunk To Read files

Prakash493 — Tue, 02 Jul 2019 16:33:21 GMT

tried with it , didnt worked , i am in indexer cluster and search head cluster environment , where i can disable through deployment server ?

Re: Stop Splunk To Read files

wenthold — Tue, 02 Jul 2019 16:39:09 GMT

Use btool to list out your current configuration. for whatever platform you're on go to the command line into the $SPLUNK_HOME folder and run:

bin/splunk btool inputs list 'monitor://C:\UCX\dotnet\UCXWinPortal\logs...\Pinnacle_AX_*.log' --debug

That command is for linux - for windows I believe it would be bin\splunk.exe btool ...

If you don't get any results, drop the configuration stanza and just run "splunk btool inputs list --debug | more" and find your configuration. It should tell you what Splunk sees as the combined configuration, and the configuration file source it's using for each item.

Use btool to troubleshoot configurations

Re: Stop Splunk To Read files

Prakash493 — Tue, 02 Jul 2019 17:35:50 GMT

it worked now actually i made a mistake on my blacklist regex syntax: i added blacklist = /.(log)$ , and it worked , Thanks

Re: Stop Splunk To Read files

493669 — Tue, 02 Jul 2019 17:36:06 GMT

Where are your stanza is written? is it indexer or heavy forwarder or universal forwarder?