Getting Data In

Blacklist not working

ryu8450
New Member

Dear Experts,
I am trying to blacklist a log file.
My Stanza looks like this which is located in /opt/splunkforwarder/etc/apps/search/local/inputs.conf

[monitor:///www/a/logs/*.log]
blacklist = /www/a/logs/hotimportexport.log
disabled = false
index = main
sourcetype = Test

Can someone please tell me why my blacklist is not working?

Thanks,

Tags (1)
0 Karma

somesoni2
Revered Legend

Try removing the full path name from the blacklist attribute.

[monitor:///www/a/logs/*.log] 
blacklist = hotimportexport.log 
disabled = false 
index = main 
sourcetype = Test
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Long before a new capability reaches the keynote stage, it begins as an idea waiting to be tested. At ...

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Why Universal Forwarders Should Not Be Used as Intermediate Forwarders A practical Splunk forwarding topology ...

Data Management Digest – August 2026

Data Management Digest   Welcome to the August 2026 edition of Data Management Digest! August was a big month ...