topic Re: blacklist file form inputs.conf in Splunk Search

blacklist file form inputs.conf

smudge797 — Tue, 24 Jun 2014 14:08:53 GMT

Here is my input.conf.

[monitor:///tcom/servers/.../logs/*]
blacklist = this_log.log-12345678
sourcetype = app
index = tcom

I know this is wrong as its not working this_log.log-12345678 files are getting in, i think I need a regex to make the blacklist work.. Is that correct? Im pretty new to regex so any help would be greatly appreciated.

Thanks!

Re: blacklist file form inputs.conf

somesoni2 — Tue, 24 Jun 2014 14:15:18 GMT

Try with this

[monitor:///tcom/servers/.../logs/*] 
blacklist = this_log\.log-\d{8}$
sourcetype = app 
index = tcom

Re: blacklist file form inputs.conf

smudge797 — Tue, 24 Jun 2014 14:36:48 GMT

so the figure 12345678 are actually a year month dat ie 20140624...

Re: blacklist file form inputs.conf

smudge797 — Mon, 28 Sep 2020 17:01:18 GMT

this_log.log-\d{8}$
I am now seeing logs from:
logs/tomcat_access_2014-07-09.log

Would this be the correct regex? It's not working...?

"blacklist = tomcat_access_\d{4}-\d{2}-\d{2}.log$"

Re: blacklist file form inputs.conf

smudge797 — Mon, 28 Sep 2020 17:01:21 GMT

I am now seeing logs from:
logs/tomcat_access_2014-07-09.log

Would this be the correct regex? It's not working...?

"blacklist = tomcat_access_\d{4}-\d{2}-\d{2}.log$"

backslashes are missing in here for some reason.

Re: blacklist file form inputs.conf

somesoni2 — Mon, 28 Sep 2020 17:01:27 GMT

Are you adding new blacklist attribute? or just updating the existing one (and restarting after changing the file)? The regex "blacklist = tomcat_access_\d{4}-\d{2}-\d{2}\.log$" looks correct to me. If possible post your current inputs.conf entry for this.

Re: blacklist file form inputs.conf

nawazns5038 — Tue, 03 Jan 2017 23:33:52 GMT

put a \ before .

.log$

Re: blacklist file form inputs.conf

u519899 — Wed, 30 Sep 2020 01:01:14 GMT

try this regex

[monitor:///tcom/servers/.../logs/*]
blacklist = .+tomcat_access_\d{4}\D\d{2}\D\d{2}.log$
index=yourindexname
sourcetype=yoursourcetypename

Re: blacklist file form inputs.conf

u519899 — Wed, 30 Sep 2020 01:01:17 GMT

try this
blacklist = .+tomcat_access_\d{4}\D\d{2}\D\d{2}.log$