Hi , currently i need splunk to stop reading the log files from below source location , i updated disabled=true to stop splunk to read files but it still reading and added the blacklist stanza too but nothing works , splunk is still reading and indexing files , Please tell me how can i stop splunk to read the below entire source path ?
disabled = true
recursive = false
index = xxxxx
sourcetype = xxxxx
blacklist = .(log)$
Use btool to list out your current configuration. for whatever platform you're on go to the command line into the $SPLUNK_HOME folder and run:
bin/splunk btool inputs list 'monitor://C:\UCX\dotnet\UCXWinPortal\logs...\Pinnacle_AX_*.log' --debug
That command is for linux - for windows I believe it would be bin\splunk.exe btool ...
If you don't get any results, drop the configuration stanza and just run "splunk btool inputs list --debug | more" and find your configuration. It should tell you what Splunk sees as the combined configuration, and the configuration file source it's using for each item.
Try below in inputs.conf-
[monitor://C:\UCX\dotnet\UCXWinPortal\logs...\Pinnacle_AX_*.log] disabled = 1
Also You can disable from UI
go to the Web UI -> Settings - Data Inputs -> Files and Directories -> Disable particular input