How do you exclude files in a directory?

balcv — Tue, 29 Sep 2020 23:54:19 GMT

I've been struggling with this for several days now and cannot find a solution that works for me so I am turning to you all.

I simply want to exclude 2 files from a directory from being indexed. The two files exist on one of my Linux servers and are in the /var/log/httpd directory along with regular Apache log files that I DO want indexed. The two files to be excluded are 64080_access_log and 64080_error_log.

From what I have read, the solution should be to have a blacklist line in the inputs.conf file, which I have done in the /splunk/etc/apps/Splunk_TA_nix/local directory, and it looks like:

[monitor:///var/log/httpd]
blacklist=64080_access_log|64080_error_log
disabled = true

But this is not working. After a restart of Splunk, I am still seeing log data from the blacklisted files.

In case it's relevant, I have my main Splunk host that receives those logs, and does the indexing, and that is the host I have added the above code to. I also have a heavy forwarder setup as my Universal Forwarder deployment server, but it does not receive or process any log data. Am I right in adding the above code to the main Splunk server that is receiving the log data?

Many thanks.

Re: How do you exclude files in a directory?

damann — Thu, 28 Mar 2019 22:12:39 GMT

change disabled=true to disabled=false to activate your stanza

Re: How do you exclude files in a directory?

balcv — Thu, 28 Mar 2019 22:16:03 GMT

Damn these double negatives!! I looked at that then talked myself into it being correct.

Thanks @damann.

Re: How do you exclude files in a directory?

balcv — Thu, 28 Mar 2019 22:20:07 GMT

I feel like such a noob for this one!!

topic Re: How do you exclude files in a directory? in Splunk Search

How do you exclude files in a directory?

Re: How do you exclude files in a directory?

Re: How do you exclude files in a directory?

Re: How do you exclude files in a directory?