Archive
Highlighted

Disable monitoring of sub directories

Path Finder

Hello

How can I monitor the files within a directory but ignore its subdirectories?

e.g. I want to monitor all files in c:\mydir

However mydir contains a folder called temp how can I configure my inputs.conf file so that the files in the folder temp are not monitored.

I know I can use a blacklist for temp, however lets say mydir contains numorous other directories is there a way to just blacklist all directories within mydir?

Ta, Josh

Highlighted

Re: Disable monitoring of sub directories

Splunk Employee
Splunk Employee

You can use the blacklist:

_blacklist = (?i)^c:\\mydir\\[^\\]+\\

View solution in original post

Highlighted

Re: Disable monitoring of sub directories

Splunk Employee
Splunk Employee

You can also use a wildcard to only include immediate files within the directory.

[monitor://c:\mydir\*]