Blacklist a file in my inputs.conf stanza?

daniel333 · ‎09-09-2019

All,

I am getting an alert "Saved Search [ForwarderLevel - File Too Small to checkCRC occurring multiple times]: number of events (18) "

The file is a file on my Solaris boxes.

'/etc/dfs/sharetab'

I don't care about this file, so I thought I could just black list it in my inputs.conf like this. But doens't seem to be working. Any idea what I am missing?

[monitor:///etc]
  index = configs
whitelist=(\.conf|\.cfg|config$|\.ini|\.init|\.cf|\.cnf|shrc$|^ifcfg|\.profile|\.rc|\.rules|\.tab|tab$|\.login|policy$)
  blacklist = sharetab
disabled = False

jacobpevans · ‎09-09-2019

I'm not personally familiar with blacklisting, but I'm fairly confident you just need to use regex, e.g.:

blacklist = */sharetab/?*

https://docs.splunk.com/Documentation/Splunk/latest/Admin/InputsConf#MONITOR:

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

Blacklist a file in my inputs.conf stanza?

Index This | Why did the turkey cross the road?

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Feel the Splunk Love: Real Stories from Real Customers

Are you a member of the Splunk Community?

Blacklist a file in my inputs.conf stanza?

Index This | Why did the turkey cross the road?

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Feel the Splunk Love: Real Stories from Real Customers