Getting Data In

Blacklist not working

ryu8450
New Member

Dear Experts,
I am trying to blacklist a log file.
My Stanza looks like this which is located in /opt/splunkforwarder/etc/apps/search/local/inputs.conf

[monitor:///www/a/logs/*.log]
blacklist = /www/a/logs/hotimportexport.log
disabled = false
index = main
sourcetype = Test

Can someone please tell me why my blacklist is not working?

Thanks,

Tags (1)
0 Karma

somesoni2
Revered Legend

Try removing the full path name from the blacklist attribute.

[monitor:///www/a/logs/*.log] 
blacklist = hotimportexport.log 
disabled = false 
index = main 
sourcetype = Test
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...