Getting Data In

Blacklist not working

ryu8450
New Member

Dear Experts,
I am trying to blacklist a log file.
My Stanza looks like this which is located in /opt/splunkforwarder/etc/apps/search/local/inputs.conf

[monitor:///www/a/logs/*.log]
blacklist = /www/a/logs/hotimportexport.log
disabled = false
index = main
sourcetype = Test

Can someone please tell me why my blacklist is not working?

Thanks,

Tags (1)
0 Karma

somesoni2
Revered Legend

Try removing the full path name from the blacklist attribute.

[monitor:///www/a/logs/*.log] 
blacklist = hotimportexport.log 
disabled = false 
index = main 
sourcetype = Test
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Improve Delivery Assurance with S2S ACK for Edge Processor

Edge Processor helps Splunk customers process data closer to the source: filtering, transforming, masking, and ...

.conf26 Platform Sessions: Turn Machine Data into Agentic Action

As autonomous agents and multi-cloud architectures reshape modern IT, data platforms have to do far more than ...

Introducing the Launch of Edge Processor in Hybrid Mode!

Modernize Data Ingestion Without Starting Over  For years, organizations have relied on Splunk's proven ...