topic Re: Excluding a source in Splunk Search

Excluding a source

balcv — Wed, 30 Sep 2020 04:12:07 GMT

I have a host sending log data and I am wanting to exclude a specific directory from being ingested and/or indexed but no matter what I try, the data continues to appear.

I am using a heavy forwarder that is acting as my config server for the agent and I have the indexer on another instance.

The source to be excluded is "/var/log/lsyncd/lsyncd-status.log" but I['m logging to exclude the "/var/log/lsyncd" directory

I have tried adding the following to $SPLUNK/apps/Splunk_TA_nix/local/inputs.conf on both the forwarder and indexer both but the data continues to flow:

monitor:///var/log/lsyncd
disabled = false

I have also tried adding a blacklist option using blacklist=(*.log) but again without the desired result.

What am I missing or how should I be configuring this?

Re: Excluding a source

richgalloway — Fri, 14 Feb 2020 00:56:07 GMT

The monitor statement you tried enables an input, it does not disable one.
The blacklist may work, but the inputs.conf file must be installed on the agent rather than the forwarder or indexer.

Re: Excluding a source

balcv — Fri, 14 Feb 2020 02:31:39 GMT

I've changed to disabled=true and I have re-loaded the config out to the agents, but still receiving the data.

Re: Excluding a source

manjunathmeti — Fri, 14 Feb 2020 04:28:04 GMT

Your monitor should be a stanza in inputs.conf on the forwarders.

 [monitor:///var/log/lsyncd]
 disabled = 1

Re: Excluding a source

balcv — Sun, 16 Feb 2020 23:05:52 GMT

Thanks for that but this is exactly what I have in my inputs.conf yet the logs still keep coming through. Getting very frustrated.

Re: Excluding a source

manjunathmeti — Mon, 17 Feb 2020 02:40:58 GMT

Use btool to verify the attributes for this stanza. Check if it is actually disabled.

$SPLUNK_HOME/bin/splunk btool inputs list --debug